Linux 中的守护进程登录

Daemon logging in Linux

提问by codemonkey

So I have a daemon running on a Linux system, and I want to have a record of its activities: a log. The question is, what is the "best" way to accomplish this?

所以我有一个运行在 Linux 系统上的守护进程，我想记录它的活动：一个日志。问题是，实现这一目标的“最佳”方法是什么？

My first idea is to simply open a file and write to it.

我的第一个想法是简单地打开一个文件并写入它。

FILE* log = fopen("logfile.log", "w");
/* daemon works...needs to write to log */
fprintf(log, "foo%s\n", (char*)bar);
/* ...all done, close the file */
fclose(log);

Is there anything inherently wrong with logging this way? Is there a better way, such as some framework built into Linux?

以这种方式记录有什么本质上的错误吗？有没有更好的方法，例如 Linux 中内置的一些框架？

采纳答案by Vinko Vrsalovic

Unix has had for a long while a special logging framework called syslog. Type in your shell

Unix 长期以来一直有一个名为syslog的特殊日志框架。输入你的外壳

man 3 syslog

and you'll get the help for the C interface to it.

您将获得 C 接口的帮助。

Someexamples

一些例子

#include <stdio.h>
#include <unistd.h>
#include <syslog.h>

int main(void) {

 openlog("slog", LOG_PID|LOG_CONS, LOG_USER);
 syslog(LOG_INFO, "A different kind of Hello world ... ");
 closelog();

 return 0;
}

回答by David Nehme

There are a lot of potential issues: for example, if the disk is full, do you want your daemon to fail? Also, you will be overwriting your file every time. Often a circular file is used so that you have space allocated on the machine for your file, but you can keep enough history to be useful without taking up too much space. There are tools like log4c that you can help you. If your code is c++, then you might consider log4cxx in the Apache project (apt-get install liblog4cxx9-dev on ubuntu/debian), but it looks like you are using C.

有很多潜在的问题：例如，如果磁盘已满，您是否希望守护程序失败？此外，您每次都会覆盖您的文件。通常使用循环文件，以便在机器上为文件分配空间，但您可以保留足够的历史记录以供使用，而不会占用太多空间。有像 log4c 这样的工具可以帮助你。如果你的代码是c++，那么你可能会考虑Apache项目中的log4cxx（ubuntu/debian上的apt-get install liblog4cxx9-dev），但看起来你使用的是C。

回答by Richard

This is probably going to be awas horse race, but yes the syslog facility which exists in most if not all Un*x derivatives is the preferred way to go. There is nothing wrong with logging to a file, but it does leave on your shoulders an number of tasks:

这可能会是一场赛马，但是是的，存在于大多数（如果不是全部）Un*x 衍生品中的 syslog 工具是首选方式。记录到文件没有任何问题，但它确实让您肩负了许多任务：

• is there a file system at your logging location to save the file
• what about buffering (for performance) vs flushing (to get logs written before a system crash)
• if your daemon runs for a long time, what do you do about the ever growing log file.

• 您的日志记录位置是否有文件系统来保存文件
• 缓冲（为了性能）与刷新（在系统崩溃之前写入日志）呢？
• 如果您的守护进程运行了很长时间，您会如何处理不断增长的日志文件。

Syslog takes care of all this, and more, for you. The API is similar the printf clan so you should have no problems adapting your code.

Syslog 会为您处理所有这些，甚至更多。API 类似于 printf 族，因此您在调整代码时应该没有问题。

回答by phreakre

I spit a lot of daemon messages out to daemon.info and daemon.debug when I am unit testing. A line in your syslog.conf can stick those messages in whatever file you want.

当我进行单元测试时，我向 daemon.info 和 daemon.debug 吐出很多守护进程消息。syslog.conf 中的一行可以将这些消息粘贴到您想要的任何文件中。

http://www.linuxjournal.com/files/linuxjournal.com/linuxjournal/articles/040/4036/4036s1.htmlhas a better explanation of the C API than the man page, imo.

http://www.linuxjournal.com/files/linuxjournal.com/linuxjournal/articles/040/4036/4036s1.html比手册页 imo 对 C API 有更好的解释。

回答by Mathias Brossard

As stated above you should look into syslog. But if you want to write your own logging code I'd advise you to use the "a" (write append) mode of fopen.

如上所述，您应该查看系统日志。但是，如果您想编写自己的日志记录代码，我建议您使用 fopen 的“a”（写入附加）模式。

A few drawbacks of writing your own logging code are: Log rotation handling, Locking (if you have multiple threads), Synchronization (do you want to wait for the logs being written to disk ?). One of the drawbacks of syslog is that the application doesn't know if the logs have been written to disk (they might have been lost).

编写自己的日志代码的一些缺点是：日志轮换处理、锁定（如果您有多个线程）、同步（您想等待日志写入磁盘吗？）。syslog 的缺点之一是应用程序不知道日志是否已写入磁盘（它们可能已丢失）。

回答by Jon Topper

Syslog is a good option, but you may wish to consider looking at log4c. The log4[something] frameworks work well in their Java and Perl implementations, and allow you to - from a configuration file - choose to log to either syslog, console, flat files, or user-defined log writers. You can define specific log contexts for each of your modules, and have each context log at a different level as defined by your configuration. (trace, debug, info, warn, error, critical), and have your daemon re-read that configuration file on the fly by trapping a signal, allowing you to manipulate log levels on a running server.

Syslog 是一个不错的选择，但您可能希望考虑查看 log4c。log4[something] 框架在它们的 Java 和 Perl 实现中运行良好，并允许您 - 从配置文件 - 选择记录到系统日志、控制台、平面文件或用户定义的日志编写器。您可以为每个模块定义特定的日志上下文，并使每个上下文日志处于您的配置所定义的不同级别。（跟踪、调试、信息、警告、错误、严重），并让您的守护程序通过捕获信号动态重新读取该配置文件，从而允许您在正在运行的服务器上操作日志级别。

回答by Dave Sherohman

One other advantage of syslog in larger (or more security-conscious) installations: The syslog daemon can be configured to send the logs to another server for recording there instead of (or in addition to) the local filesystem.

syslog 在较大（或更具安全意识）的安装中的另一个优点：可以配置 syslog 守护进程将日志发送到另一台服务器进行记录，而不是（或除了）本地文件系统。

It's much more convenient to have all the logs for your server farm in one place rather than having to read them separately on each machine, especially when you're trying to correlate events on one server with those on another. And when one gets cracked, you can't trust its logs any more... but if the log server stayed secure, you know nothing will have been deleted from its logs, so any record of the intrusion will be intact.

将服务器群的所有日志放在一个地方更方便，而不必在每台机器上分别读取它们，尤其是当您尝试将一台服务器上的事件与另一台服务器上的事件相关联时。当一个人被破解时，你不能再相信它的日志……但是如果日志服务器保持安全，你知道它的日志中不会有任何内容被删除，因此任何入侵记录都将完好无损。

回答by Zan Lynx

If you use threading and you use logging as a debugging tool, you will want to look for a logging library that uses some sort of thread-safe, but unlocked ring buffers. One buffer per thread, with a global lock only when strictly needed.

如果您使用线程并将日志记录用作调试工具，您将需要寻找使用某种线程安全但未锁定的环形缓冲区的日志记录库。每个线程一个缓冲区，只有在严格需要时才使用全局锁。

This avoids logging causing serious slowdowns in your software and it avoids creating heisenbugs which change when you add debug logging.

这可避免日志记录导致软件严重减速，并避免创建在添加调试日志记录时发生变化的 heisenbug。

If it has a high-speed compressed binary log format that doesn't waste time with format operations during logging and some nice log parsing and display tools, that is a bonus.

如果它具有高速压缩二进制日志格式，并且不会在日志记录期间浪费时间进行格式操作以及一些不错的日志解析和显示工具，那么这是一个好处。

I'd provide a reference to some good code for this but I don't have one myself. I just want one. :)

我会为此提供一些好的代码的参考，但我自己没有。我只想要一个。:)

回答by Matthew Smith

Our embedded system doesn't have syslog so the daemons I write do debugging to a file using the "a" open mode similar to how you've described it. I have a function that opens a log file, spits out the message and then closes the file (I only do this when something unexpected happens). However, I also had to write code to handle log rotation as other commenters have mentioned which consists of 'tail -c 65536 logfile > logfiletmp && mv logfiletmp logfile'. It's pretty rough and maybe should be called "log frontal truncations" but it stops our small RAM disk based filesystem from filling up with log file.

我们的嵌入式系统没有 syslog，所以我编写的守护进程使用类似于您描述的“a”打开模式对文件进行调试。我有一个函数可以打开一个日志文件，输出消息然后关闭文件（我只在发生意外时才这样做）。但是，我还必须编写代码来处理日志轮换，正如其他评论者提到的那样，其中包含“tail -c 65536 logfile > logfiletmp && mv logfiletmp logfile”。这很粗糙，也许应该被称为“日志正面截断”，但它阻止了我们基于小型 RAM 磁盘的文件系统被日志文件填满。

回答by alexkr

So far nobody mentioned boost log librarywhich has nice and easy way to redirect your log messages to files or syslog sinkor even Windows event log.

到目前为止，没有人提到boost 日志库，它具有将日志消息重定向到文件或系统日志接收器甚至 Windows 事件日志的好方法。