DAEMONLOGGER(1) General Commands Manual DAEMONLOGGER(1)NAME
daemonlogger - simple network logger and soft tap daemon
SYNOPSIS
daemonlogger [Options]
DESCRIPTION
daemonlogger is a simple network packet logger and soft tap daemon. It is able to log packets to file or mirror to another interface.
OPTIONS --help
Show summary of options.
-v
Show version of program.
-c <count>
Log <count> packets and exit.
-d
Run as a daemon.
-f <bpf file>
Load bpf filter from file.
-F
Flush the pcap buffer for each packet.
-g <group id>
Set group to <group id>.
-u <user name>
Set user to <user name>.
-i <interface>
Set interface to grab data from to <interface>.
-l <path>
Set log directory to <path>.
-m <count>
Generate <count> number of log files and exit.
-n <name>
Set ouput file prefix to <name>.
-o <interface>
Disable logging, instead mirror traffic from -i <interface> to -o <interface>.
-p <pidfile>
Set PID filename to <pidfile>.
-P <path>
Set PID path to <path>.
-r
Activate ringbuffer mode.
-R <pcap file>
Read packets from <pcap file>
-s <bytes>
Automatically roll over the log file after <bytes>.
-S <snaplen>
Set number of bytes per packet to capture to <snaplen>.
-t <seconds>
Rollover the log file on time intervals. Append an 'm' to rollover on minute boundaries, 'h' to rollover on hour boundaries and 'd' to
rollover on day boundaries. If no interval selector is used then the default rollover interval is in seconds. For example, "-t 60" rolls
the log file over every 60 seconds and "-t 2h" rolls the log file over every two hours at the top of the hour. In the case of
minute/hour/day-based rollovers, the will round to the next highest hour. For example, if the program is told to rollover every 2 hours
and is started 38 minutes into the current hour it will add 2 to the current hour and rollover as scheduled at the top of the hour at <cur-
rent hour> + 2. If the program was started at 13:38 it would roll over the logfile at 15:00.
-T <chroot dir>
Chroot daemonlogger to <chroot dir>
-z
Select log file pruning behavior. Omitting this switch results in the default mode being used where the oldest log file in the logging
directory is pruned. Setting the -z switch changes the behavior so that Daemonlogger will prune the oldest file from its current instanti-
ation and leave files from older runs in the same logging directory alone
RESOURCES
The daemonlogger README can be found at /usr/share/doc/daemonlogger/README.gz
The daemonlogger homepage can be found at <http://www.snort.org/users/roesch/Site/Daemonlogger/Daemonlogger.html>
AUTHOR
daemonlogger was written by Martin Roesch <roesch@sourcefire.com>.
This manual page was written by Chris Taylor <ctaylor@debian.org>, for the Debian project (but may be used by others).
December 08, 2009 DAEMONLOGGER(1)
Check Out this Related Man Page
ROTATELOGS(8) rotatelogs ROTATELOGS(8)NAME
rotatelogs - Piped logging program to rotate Apache logs
SYNOPSIS
rotatelogs [ -l ] [ -f ] logfile rotationtime|filesizeM [ offset ]
SUMMARY
rotatelogs is a simple program for use in conjunction with Apache's piped logfile feature. It supports rotation based on a time interval or
maximum size of the log.
OPTIONS -l Causes the use of local time rather than GMT as the base for the interval or for strftime(3) formatting with size-based rotation.
Note that using -l in an environment which changes the GMT offset (such as for BST or DST) can lead to unpredictable results!
-f Causes the logfile to be opened immediately, as soon as rotatelogs starts, instead of waiting for the first logfile entry to be read
(for non-busy sites, there may be a substantial delay between when the server is started and when the first request is handled,
meaning that the associated logfile does not "exist" until then, which causes problems from some automated logging tools). Available
in version 2.2.9 and later.
logfile
The path plus basename of the logfile. If logfile includes any '%' characters, it is treated as a format string for strftime(3).
Otherwise, the suffix .nnnnnnnnnn is automatically added and is the time in seconds. Both formats compute the start time from the
beginning of the current period. For example, if a rotation time of 86400 is specified, the hour, minute, and second fields created
from the strftime(3) format will all be zero, referring to the beginning of the current 24-hour period (midnight).
rotationtime
The time between log file rotations in seconds. The rotation occurs at the beginning of this interval. For example, if the rotation
time is 3600, the log file will be rotated at the beginning of every hour; if the rotation time is 86400, the log file will be
rotated every night at midnight. (If no data is logged during an interval, no file will be created.)
filesizeM
The maximum file size in megabytes followed by the letter M to specify size rather than time.
offset The number of minutes offset from UTC. If omitted, zero is assumed and UTC is used. For example, to use local time in the zone UTC
-5 hours, specify a value of -300 for this argument. In most cases, -l should be used instead of specifying an offset.
EXAMPLES
CustomLog "|bin/rotatelogs /var/logs/logfile 86400" common
This creates the files /var/logs/logfile.nnnn where nnnn is the system time at which the log nominally starts (this time will always be a
multiple of the rotation time, so you can synchronize cron scripts with it). At the end of each rotation time (here after 24 hours) a new
log is started.
CustomLog "|bin/rotatelogs -l /var/logs/logfile.%Y.%m.%d 86400" common
This creates the files /var/logs/logfile.yyyy.mm.dd where yyyy is the year, mm is the month, and dd is the day of the month. Logging will
switch to a new file every day at midnight, local time.
CustomLog "|bin/rotatelogs /var/logs/logfile 5M" common
This configuration will rotate the logfile whenever it reaches a size of 5 megabytes.
ErrorLog "|bin/rotatelogs /var/logs/errorlog.%Y-%m-%d-%H_%M_%S 5M"
This configuration will rotate the error logfile whenever it reaches a size of 5 megabytes, and the suffix to the logfile name will be cre-
ated of the form errorlog.YYYY-mm-dd-HH_MM_SS.
PORTABILITY
The following logfile format string substitutions should be supported by all strftime(3) implementations, see the strftime(3) man page for
library-specific extensions.
o %A - full weekday name (localized)
o %a - 3-character weekday name (localized)
o %B - full month name (localized)
o %b - 3-character month name (localized)
o %c - date and time (localized)
o %d - 2-digit day of month
o %H - 2-digit hour (24 hour clock)
o %I - 2-digit hour (12 hour clock)
o %j - 3-digit day of year
o %M - 2-digit minute
o %m - 2-digit month
o %p - am/pm of 12 hour clock (localized)
o %S - 2-digit second
o %U - 2-digit week of year (Sunday first day of week)
o %W - 2-digit week of year (Monday first day of week)
o %w - 1-digit weekday (Sunday first day of week)
o %X - time (localized)
o %x - date (localized)
o %Y - 4-digit year
o %y - 2-digit year
o %Z - time zone name
o %% - literal `%'
Apache HTTP Server 2008-05-10 ROTATELOGS(8)