[ previous ] [ next ] [ threads ]
 From:  Adam Nellemann <adam at nellemann dot nu>
 Cc:  m0n0wall at lists dot m0n0 dot ch
 Subject:  Re: [m0n0wall] cf-image
 Date:  Sun, 02 May 2004 15:04:10 +0200

fisch wrote:

> I want to use the free space for logging, because I don't have a
> syslog-server running all time.

I have the same problem as I'm currently using my workstation as 
syslog server. However, since I'm soon to have a dedicated fileserver, 
I plan to do my syslogging on that box in the future.

Ideally I'd like m0n0wall to have some kind of "buffering" for 
syslogs, such that it would keep its syslog entries in RAM when the 
syslog server isn't available, and then dump these whenever it becomes 
available again (having 256Mb RAM in my m0n0wall box, I should think 
there would be plenty of room, even if it is days between the syslog 
server being online). However, I must assume this would require some 
rather laborious changes to the m0n0wall code (possibly requiring the 
whole syslog daemon to be rewritten?) and all for a rather unimportant 
feature, therefore I don't plan to bother Manuel with such a suggestion.

As others have pointed out, using your CF for syslogging may cause the 
CF to fail after some time. But compared to paying for a dedicated 
syslog box, you might prefer buying a new CF from time to time 
(ideally you should do so before it actually fails, based on some 
estimate of how long this will take?)

Alternativly, you could get one of those harddisk (microdrive) based 
CF's, which will be expensive, but should last much longer (and 
hopefully not as expensive as an entire syslog box).

It might also be possible for you to dump your syslog messages 
directly to a printer. I don't think m0n0wall currently has support 
for printers, but it might be possible for you to hack you own printer 
driver and have a small php script dump the logs as needed?

Perhaps it might even possible to find one of those small printservers 
that is also capable of recieving syslog messages (I know mine will 
send syslogs, but I'm not sure it will recieve them as well?)

Well, just my 2 cents.