1 files changed, 83 insertions, 0 deletions
diff --git a/doc/src/internals.xml b/doc/src/internals.xml
new file mode 100644
index 0000000..0ac12ec
--- /dev/null
+++ b/doc/src/internals.xml
@@ -0,0 +1,83 @@
+<para>
+There are three basic parts of daemon: listener, message processor and
+message writer.
+All these parts run in separate threads:
+the listener receives messages as fast as possible and passes them to the
+message processor,
+the message processor performs time-consuming tasks and
+message writer performs asynchronous output to files.
+</para>
+<para>
+Datagrams are received by the listener.
+The listener emits raw messages (struct raw_message) which contain content
+of datagram, sender address and reference to a source described
+in configuration file.
+</para>
+<para>
+Raw messages are passed to the processing thread via queue.
+Message processing involves the following tasks:
+	<itemizedlist>
+		<listitem>
+			<para>
+parse datagram:
+pick out PRI, TIMESTAMP, HOSTNAME, TAG an CONTENT according to
+<ulink url="http://www.ietf.org/rfc/rfc3164.txt">RFC 3164</ulink>;
+			</para>
+		</listitem>
+		<listitem>
+			<para>
+convert CONTENT's encoding if specified;
+			</para>
+		</listitem>
+		<listitem>
+			<para>
+determine sender host name if <option>usedns</option> option is set or just
+convert IP address to string;
+the result is saved in hostname cache to speed up subsequent resolutions;
+			</para>
+		</listitem>
+		<listitem>
+			<para>
+multiplex message to logpaths and apply filters in logpaths;
+in other words, messages are multiplexed to logpaths through filters;
+messages in logpaths are represented with references to message structure
+and message structure contains reference count;
+			</para>
+		</listitem>
+	</itemizedlist>
+Because destination file name may be a pattern, further multiplexing is
+performed. Messages with similar HOSTNAME, TAG and CONTENT are coalesced.
+</para>
+<para>
+Log rotation is initiated at process startup or at writing thread startup.
+</para>
+<para>
+Old log files are deleted by the purger which is launched at process startup
+or by the writing thread after file is closed.
+	<screen>
++--------+ raw message +-----+    +------+ message +-----------------+
+|listener|------------>|queue|--->|parser|-------->|charset converter|--->
++--------+             +-----+    +------+         +-----------------+
+
+    +------+    +-----------+    +-----------+
+--->|filter|--->|multiplexer|-+->|destination|+
+    +------+    +-----------+ +->+-----------+|+
+                      ^       +-> +-----------+|
+                      |            +-----------+
+                  +-------+
+                  |logpath|+
+                  +-------+|+
+                   +-------+|
+                    +-------+
+
+
+                +-----------+    +-----+        +--------------+
+destination: >--|multiplexer|-+->|queue|+  ---> |writing thread|+
+                +-----------+ +->+-----+|+ ---> +--------------+|+
+                      ^       +-> +-----+| --->  +--------------+|
+                      |            +-----+        +--------------+
+              +----------------+
+              |filename pattern|
+              +----------------+
+	</screen>
+</para>