multilog supports automatically rotated logs, there is no need for any other tool running from cron or similar to rotate the logs.
multilog keeps a specified number of logfiles with a maximum file size, so it is possible to calculate a logfile partition properly.
For example, this log/run file
#!/bin/sh
LOGDIR=/var/log/socklog
exec setuidgid log multilog s4999999 n10 ${LOGDIR}/main \
s999999 n5 -* +kern.* ${LOGDIR}/kern \
s999999 n5 -* +user.* ${LOGDIR}/user \
s999999 n5 -* +mail.* ${LOGDIR}/mail \
s999999 n5 -* +daemon.* ${LOGDIR}/daemon \
s999999 n5 -* +auth.* +authpriv.* ${LOGDIR}/auth \
s999999 n5 -* +syslog.* ${LOGDIR}/syslog \
s999999 n5 -* +news.* ${LOGDIR}/news \
s999999 n5 -* +cron.* ${LOGDIR}/cron \
s999999 n5 -* +ftp.* ${LOGDIR}/ftp \
s999999 n5 -* +local*.* ${LOGDIR}/local \
s999999 n5 -* +*.debug* ${LOGDIR}/debug
causes
multilog
to hold maximal 10 logfiles, each of maximal size
4999999 bytes in /var/log/socklog/main/, maximal 5 logfiles,
each of maximal size 999999 bytes in /var/log/socklog/kern/,
/var/log/socklog/user/, ...
So the maximal used space for all these directories is less then:
10 * 5000000 + 11 * 5 * 1000000 = 105000000 bytes < 110 MB
If there is any service acting up and filling up your logs rapidly, you will never run into a filled up log partition, causing loss of new log entries, even of other services. You can lose old log entries from this service, but will ever have the recent ones.
Please note that above numbers could change if you use multilog with a processor.
This is much more flexible than the usual syslogd support for selecting log entries by facility and priority. Of course, selecting entries by facility or priority is still possible with socklog and multilog, just like the default socklog-unix configuration shows.
This line selection feature is also used for socklog's instant Log events notification.
socklog does not support this UDP network logging on the client side. socklog provides a different modular, reliable Network logging concept instead. Logs are transmitted through network using a TCP connection in the default configuration, log transmission failures are catched. The modular design of daemontools and socklog makes it possible to insert encryption, authentication, compression, and more easily.
This minimizes the possibility of bugs introduced by programmer's fault, and makes it more easy for security related people to proofread the source code.
Of course this also means that socklog never will evolve to a multi-/overfeatured, bloated project.