Re: stopping multilog

richard lucassen <[email protected]> Mon, 29 Sep 2008 18:14:45 +0200
Newsgroups gmane.comp.djb.syslog
Organization XAQ Systems
Message-ID <[email protected]>
On Sun, 28 Sep 2008 17:52:34 -0300
Otavio Exel <[email protected]> wrote:

> richard lucassen wrote:
> > #!/bin/sh
> > exec 2>&1
> > 
> > exec /usr/local/bin/multilog \
> >   '-*' '+*mark=384*' \
> >   !"/root/dynfw3/conntrack/log/processor1" s16777215 n2 ./eth0 \
> >   '-*' '+*mark=387*' \
> >   !"/root/dynfw3/conntrack/log/processor2" s16777215 n2 ./eth1
> 
> > Is processor2 executed after processor1? Or are they invoked
> > simultaniously?
> 
> there is absolutely no relation between the two; processor1 will run
> when ./eth0/current exceeds the limit and processor 2 will run when
> ./eth1/current exceeds the limit; depending on the number of lines
> with "+*mark=384" and "+*mark=387" some (or both) could never run at
> all!

Oops, I forgot to tell that I rotate the logs by sending an ALARM to the
multilog process. Sorry for that.

R.

-- 
___________________________________________________________________
It is better to remain silent and be thought a fool, than to speak
aloud and remove all doubt.

+------------------------------------------------------------------+
| Richard Lucassen, Utrecht                                        |
| Public key and email address:                                    |
| http://www.lucassen.org/mail-pubkey.html                         |
+------------------------------------------------------------------+