blob: d64bf8734ad3cecba5dc3bd4b4bb279d635a260e (
plain) (
tree)
|
|
<para>
There are three basic parts of daemon: listener, message processor and
message writer.
All these parts run in separate threads:
the listener receives messages as fast as possible and passes them to the
message processor,
the message processor performs time-consuming tasks and
message writer performs asynchronous output to files.
</para>
<para>
Datagrams are received by the listener.
The listener emits raw messages (struct raw_message) which contain content
of datagram, sender address and reference to a source described
in configuration file.
</para>
<para>
Raw messages are passed to the processing thread via queue.
Message processing involves the following tasks:
<itemizedlist>
<listitem>
<para>
parse datagram:
pick out PRI, TIMESTAMP, HOSTNAME, TAG an CONTENT according to
<ulink url="http://www.ietf.org/rfc/rfc3164.txt">RFC 3164</ulink>;
</para>
</listitem>
<listitem>
<para>
convert CONTENT's encoding if specified;
</para>
</listitem>
<listitem>
<para>
determine sender host name if <option>usedns</option> option is set or just
convert IP address to string;
the result is saved in hostname cache to speed up subsequent resolutions;
</para>
</listitem>
<listitem>
<para>
multiplex message to logpaths and apply filters in logpaths;
in other words, messages are multiplexed to logpaths through filters;
messages in logpaths are represented with references to message structure
and message structure contains reference count;
</para>
</listitem>
</itemizedlist>
Because destination file name may be a pattern, further multiplexing is
performed. Messages with similar HOSTNAME, TAG and CONTENT are coalesced.
</para>
<para>
Log rotation is initiated at process startup or at writing thread startup.
</para>
<para>
Old log files are deleted by the purger which is launched at process startup
or by the writing thread after file is closed.
<screen>
+--------+ raw message +-----+ +------+ message +-----------------+
|listener|------------>|queue|--->|parser|-------->|charset converter|--->
+--------+ +-----+ +------+ +-----------------+
+------+ +-----------+ +-----------+
--->|filter|--->|multiplexer|-+->|destination|+
+------+ +-----------+ +->+-----------+|+
^ +-> +-----------+|
| +-----------+
+-------+
|logpath|+
+-------+|+
+-------+|
+-------+
file +-----------+ +-----+ +--------------+
destination: >--|multiplexer|-+->|queue|+ ---> |writing thread|+
+-----------+ +->+-----+|+ ---> +--------------+|+
^ +-> +-----+| ---> +--------------+|
| +-----+ +--------------+
+----------------+
|filename pattern|
+----------------+
relay +--------+
destination: >--|sendto()|
+--------+
</screen>
</para>
|
