On 01/20/2015 10:01 PM, Stuart Henderson wrote: >> b) For local reception, syslogd is a tightly coupled system service >> > i) using sendsyslog(2) >> > ii) jailed / stack protector failures are logged without times >> > and syslogd understands this >> > iii) started as early as possible to remember the boot story >> > >> > c) For syslog protocol proxying, syslogd can hand off to a seperate daemon >> > doing tricky remote delivery services we don't do yet > And of course this "remote" delivery can be "to another syslog running on > the same machine", which is the way I'd recommend running on OpenBSD if you > have a requirement to use some other syslogd. (If you don't want to log > to disk twice, you could just use memory buffers.) >
Yup, and this is exactly what I'm doing: I forward everything to localhost, and pick it up with syslog-ng. However, in order to make sure that everything gets logged, I have to start syslog-ng to listen before I start syslogd, which means... a dirty hack to /etc/rc. sigh. But at least I know I needn't bother trying to "improve" this.
