ulogbufd (and its companion program ulogbufdump) are my attempt at creating a dmesg-like entity in user space (because I am definitely not the programmer to go attempting to do it in kernel space...) At work, we were having trouble with logfiles - specifically, that some programs can generate so much log data that in less than 24 hours, they will create a logfile larger than the maximum defined for the filesystem. Rotating more often than once every 24 hours is kind of ugly, and doesn't really solve the heart of the problem: what if they outgrow your new, shorter rotation period? You could just make the logfile a link to /dev/null, but what if you want to be able to look at some of the logs?

Enter ulogbufd. Make your logfile a FIFO and set ulogbufd to watching it. ulogbufd will maintain a set number of lines of data in its internal FIFO. Upon receipt of a signal, it can dump its queue either to a regular file, or to screen (with the aid of ulogbufdump). It's true, I would really rather not have had a separate daemon to do this, but it was almost unavoidable. dmesg was my inspiration, but dmesg uses a kernel buffer, and if you wanted to be able to create dmesg-like capability for other files, you'd have to have a place in the filespace for them to write to, and put capability for reading it in the kernel, and have a tool that could look at that message buffer...all somewhat beyond my capabilities, and less portable, too.

I originally started writing ulogbufd when I got stuck on visproxy, but it's approached completion much more quickly. It requires Perl, and makes a couple other very minor assumptions about your system (like "you have /var/tmp" and "you have mkfifo in your path") which are easily remedied if they don't suit you.

I just discovered, almost purely at random, that someone else has been working on this problem (and he looks like a better programmer than me, too, darn it; I wanted to do something with special devices. <g>) Check out Jeremy Elson's emlog. His solution has the advantages of being cleaner and better integrated with the system; mine has the advantage of being more portable.