diff options
| -rw-r--r-- | doc/src/internals.xml | 83 | ||||
| -rw-r--r-- | doc/website/internals.xml | 17 |
2 files changed, 100 insertions, 0 deletions
diff --git a/doc/src/internals.xml b/doc/src/internals.xml new file mode 100644 index 0000000..0ac12ec --- /dev/null +++ b/doc/src/internals.xml @@ -0,0 +1,83 @@ +<para> +There are three basic parts of daemon: listener, message processor and +message writer. +All these parts run in separate threads: +the listener receives messages as fast as possible and passes them to the +message processor, +the message processor performs time-consuming tasks and +message writer performs asynchronous output to files. +</para> +<para> +Datagrams are received by the listener. +The listener emits raw messages (struct raw_message) which contain content +of datagram, sender address and reference to a source described +in configuration file. +</para> +<para> +Raw messages are passed to the processing thread via queue. +Message processing involves the following tasks: + <itemizedlist> + <listitem> + <para> +parse datagram: +pick out PRI, TIMESTAMP, HOSTNAME, TAG an CONTENT according to +<ulink url="http://www.ietf.org/rfc/rfc3164.txt">RFC 3164</ulink>; + </para> + </listitem> + <listitem> + <para> +convert CONTENT's encoding if specified; + </para> + </listitem> + <listitem> + <para> +determine sender host name if <option>usedns</option> option is set or just +convert IP address to string; +the result is saved in hostname cache to speed up subsequent resolutions; + </para> + </listitem> + <listitem> + <para> +multiplex message to logpaths and apply filters in logpaths; +in other words, messages are multiplexed to logpaths through filters; +messages in logpaths are represented with references to message structure +and message structure contains reference count; + </para> + </listitem> + </itemizedlist> +Because destination file name may be a pattern, further multiplexing is +performed. Messages with similar HOSTNAME, TAG and CONTENT are coalesced. +</para> +<para> +Log rotation is initiated at process startup or at writing thread startup. +</para> +<para> +Old log files are deleted by the purger which is launched at process startup +or by the writing thread after file is closed. + <screen> ++--------+ raw message +-----+ +------+ message +-----------------+ +|listener|------------>|queue|--->|parser|-------->|charset converter|---> ++--------+ +-----+ +------+ +-----------------+ + + +------+ +-----------+ +-----------+ +--->|filter|--->|multiplexer|-+->|destination|+ + +------+ +-----------+ +->+-----------+|+ + ^ +-> +-----------+| + | +-----------+ + +-------+ + |logpath|+ + +-------+|+ + +-------+| + +-------+ + + + +-----------+ +-----+ +--------------+ +destination: >--|multiplexer|-+->|queue|+ ---> |writing thread|+ + +-----------+ +->+-----+|+ ---> +--------------+|+ + ^ +-> +-----+| ---> +--------------+| + | +-----+ +--------------+ + +----------------+ + |filename pattern| + +----------------+ + </screen> +</para> diff --git a/doc/website/internals.xml b/doc/website/internals.xml new file mode 100644 index 0000000..345ef40 --- /dev/null +++ b/doc/website/internals.xml @@ -0,0 +1,17 @@ +<?xml version="1.0"?> +<!DOCTYPE webpage PUBLIC "-//Norman Walsh//DTD Website Full V2.6.0//EN" + "http://docbook.sourceforge.net/release/website/current/schema/dtd/website-full.dtd" [ + <!ENTITY internals SYSTEM "../src/internals.xml"> +]> + +<webpage id="internals"> + +<config param="rcsdate" value="$Date: 2005/10/18 03:48:37 $"/> + +<head> + <title>Internals</title> +</head> + +&internals; + +</webpage> |