[Logcheck-devel] Bug#801547: logtail: possibility to salt the offset-file path

[Raphaël Droz]

Package: logtail
Version: 1.3.17
Severity: wishlist

Dear Maintainer,

It's not possible to use logtail to monitor a given file from distinct
programs (for distinct uses)


The offset-file used by logtail is uniquely derived from the filename to
check thus removing the possibility for distinct programs to
use logtail to monitor the file according to their own
context/refresh-frequency/...


Eg: an Apache access_log file may be monitored by one (or even many)
munin plugins running every X minutes. Moreover it could also be used by
another custom cron, and IDS, ...

In such a situation, every program relying on logtail would only get the
file difference since the latest logtail run, whichever program triggered
it last.

A solution would be to pass, as a parameter, a "salt"
(name it offset-file-prefix/suffix, custom offset-file path/dir, ...) in
order to keep multiple offset for one file.

Eg; if implemented:
$ logtail2 --suffix=munin-log404 -f /var/log/apache2/access_log
would store and read offset from:
/var/log/apache2/access_log.munin-log404.offset



Side note:
logtail2 is useful to monitor various file in various path.
But said are not always expected to be modified in such an "external"
way. Eg: /var/log may be read-only mounted, ... ...
Having the possibility to specify where logtail should put offset files
would be nice too.


-- System Information:
Debian Release: 8.2
  APT prefers stable
  APT policy: (990, 'stable'), (500, 'stable-updates'), (90, 'unstable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.1.0-2-amd64 (SMP w/4 CPU cores)
Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: sysvinit (via /sbin/init)

Versions of packages logtail depends on:
ii  perl  5.20.2-3+deb8u1

logtail recommends no packages.

logtail suggests no packages.

-- no debconf information