Best practice to tail a log and start it as service using rc.d scripts

[Anton Yuzhaninov]

On 07/03/17 14:21, Eugene Grosbein wrote:
> For logs written using standard syslog service, there is much effective way.
> 
> 1. The syslogd daemon can run a subprocess and duplicate log stream to its
> standard input. For example, write to its config:
> 
> mail.*	"|exec nc localhost 5699 -"

It is an easy way, but not effective in terms of performance.

syslog have a big overhead and it can be a bottleneck if a lot of data
written to a log file (e. g. 10Mb/s). Better to write daemon, which will
read the file (using kqueue to be notified about new data) and send it
to a socket. I've written such daemon in Perl, but better to write it in C.

Also in case of transient network error a lot of data will be lost,
because syslogd will not wait for reconnect and buffer data.

Custom daemon can stop reading the file in case of network error,
reconnect and then continue sending data. Some data will be lost
(because there is no ACK on application level), but much less than if
syslogd is used.