# logfs

**Repository Path**: your-own-os/logfs

## Basic Information

- **Project Name**: logfs
- **Description**: logfs mounts to /var/log
- **Primary Language**: Unknown
- **License**: Not specified
- **Default Branch**: master
- **Homepage**: None
- **GVP Project**: No

## Statistics

- **Stars**: 0
- **Forks**: 0
- **Created**: 2026-03-21
- **Last Updated**: 2026-03-21

## Categories & Tags

**Categories**: Uncategorized

**Tags**: None

## README

# logfs

A FUSE-based virtual log filesystem that provides transparent log management with quota enforcement, log rotation, and log ingestion capabilities.

## Features

- **Virtual Filesystem**: Mounts at `/var/log`, making logs accessible to applications while storing them elsewhere
- **Pre-mount FD**: Opens the original `/var/log` directory before mounting, enabling writes to the underlying filesystem
- **Dual Storage Backends**: In-memory or disk-based storage with automatic migration
- **Quota Enforcement**: Automatic cleanup when storage limits are reached
- **Log Rotation**: Built-in rotation engine with logrotate config import support
- **Log Ingestion**: Replaces syslog/journald by listening on multiple sources
- **Hot Config Reload**: SIGUSR1 signal to reload configuration without restart

## Architecture

```
┌─────────────────────────────────────────────────────────────┐
│                     logfs-daemon                            │
├─────────────┬─────────────┬─────────────┬─────────────────┤
│ FUSE FS     │ Syslog      │ Journal     │ Config Manager  │
│ /var/log    │ Listener    │ Listener    │ (SIGUSR1)       │
├─────────────┴─────────────┴─────────────┴─────────────────┤
│                     Storage Backend                          │
├─────────────────────────┬───────────────────────────────────┤
│  Memory Storage         │  Disk Storage (/var/log)         │
│  (HashMap<Vec<u8>>)     │  (real files via openat)          │
└─────────────────────────┴───────────────────────────────────┘
```

## Quick Start

### Build

```bash
cargo build --release
```

### Configuration

Create `/etc/logfs/config.toml`:

```toml
[storage]
mode = "disk"
path = "/var/log"

[quota]
max_size = "10G"
strategy = "delete_oldest"

[rotation]
[[rotation.rules]]
pattern = "*.log"
max_size = "100M"
max_age = "7d"
compress = true
max_count = 5

[ingest]
syslog_socket = "/dev/log"
journal_socket = "/run/systemd/journal/socket"
udp_514 = true
tcp_514 = false

[import]
enabled = true
logrotate_dir = "/etc/logrotate.d"
priority = "override"
```

### Running

```bash
# Run as root (required for FUSE)
sudo ./target/release/logfs-daemon

# Or install as a systemd service
sudo cp logfs-daemon.service /etc/systemd/system/
sudo systemctl enable logfs-daemon
sudo systemctl start logfs-daemon
```

### Reloading Configuration

```bash
# Send SIGUSR1 to reload config
kill -USR1 $(pidof logfs-daemon)
```

## Configuration Reference

### Storage

| Option | Type | Default | Description |
|--------|------|---------|-------------|
| `mode` | string | `"disk"` | Storage mode: `"memory"` or `"disk"` |
| `path` | string | `"/var/log"` | Path for disk storage |

### Quota

| Option | Type | Default | Description |
|--------|------|---------|-------------|
| `max_size` | size | `"10G"` | Maximum storage size (K/M/G/T suffixes) |
| `strategy` | string | `"delete_oldest"` | Strategy: `"delete_oldest"`, `"rotate"`, or `"both"` |

### Rotation Rules

Each rule in `rotation.rules` array:

| Option | Type | Description |
|--------|------|-------------|
| `pattern` | string | Glob pattern to match files |
| `max_size` | size | Rotate when file exceeds this size |
| `max_age` | duration | Rotate when file exceeds this age (s/m/h/d/w) |
| `compress` | bool | Compress rotated files with gzip |
| `max_count` | number | Keep this many rotated files |
| `post_rotate` | string | Script to run after rotation |
| `missing_ok` | bool | Don't error if file is missing |

### Ingestion

| Option | Type | Default | Description |
|--------|------|---------|-------------|
| `syslog_socket` | string | `"/dev/log"` | Unix socket for syslog |
| `journal_socket` | string | `"/run/systemd/journal/socket"` | systemd-journal socket |
| `udp_514` | bool | `true` | Listen on UDP port 514 |
| `tcp_514` | bool | `false` | Listen on TCP port 514 |
| `udp_port` | number | `514` | UDP port |
| `tcp_port` | number | `514` | TCP port |

### Logrotate Import

| Option | Type | Default | Description |
|--------|------|---------|-------------|
| `enabled` | bool | `true` | Enable logrotate config import |
| `logrotate_dir` | string | `"/etc/logrotate.d"` | Directory to import from |
| `priority` | string | `"override"` | `"override"` (own rules first) or `"logrotate_first"` |

## Log Ingestion

logfs can replace traditional syslog daemons by listening on:

- **Unix socket** (`/dev/log`): Standard syslog socket
- **UDP 514**: Network syslog protocol
- **TCP 514**: Network syslog protocol with connection
- **systemd-journal socket**: Collect logs from journald

Logs are automatically routed based on the program name field in syslog messages.

## Pre-mount FD Technique

When FUSE mounts at `/var/log`, the original directory becomes hidden. logfs solves this by:

1. Opening `/var/log` with `open()` before mounting
2. Storing the file descriptor globally
3. Using `openat()` with this FD for all file operations

This allows seamless read/write access to the underlying filesystem.

## Storage Migration

When configuration changes storage mode (memory ↔ disk):

1. All existing files are read from source
2. Files are written to destination
3. New writes go to destination
4. Zero-downtime transition

## Requirements

- Linux kernel with FUSE support
- Rust toolchain (1.75+)
- Root privileges (for FUSE mounting)

## License

MIT OR Apache-2.0