2017-10-05 11:09:22
good
Our own syslog
The blackhole system supports Unix socket. So it is possible to route /dev/log
in one LXC container to the syslog of our choice, potentially the main one
of any server in the cluster. Unfortunately, syslog is now dependent on systemd and
it works differently. Further, there is plenty of noise in the /var/log/messages of a server.

So we decide to write our own syslog (called trli-syslog). Most services only report
important errors to syslog. Services such as httpd or exim have their own logs anyway.

So our syslog only works in memory. It keeps the last 1000 messages. And it is probed by
trli-mon, looking for new errors. Any error in there is worth an alarm.

The final version has 165 lines of code anyway.