rotating detail files

[Alan DeKok]

On Jun 17, 2016, at 9:42 AM, Jakob Hirsch <jh at plonk.de> wrote:
> Oh, ok. I saw that there is quite some code for this. We used our own
> module (originally developed for FR 1.x, later ported to 2.2.x) which
> simply did a open(data->dump_file, O_WRONLY|O_APPEND|O_CREAT,...) and
> close() for every packet, and never had threading or performance issues

  If you have low packet rates, that works....  If the data you write to the file descriptor is smaller than 4K, and written atomically.  And if you don't need to do locking on the file.

  The detail module doesn't do atomic writes, and it often needs locking for use with the detail file reader, and it handles 10K packets/s.  So... the current behavior is better.

  It's probably possible to do minor code modifications to the detail file to address your needs.  Add a configuration item which tells the module to open / close the file each time.  Then add in hooks to avoid the calls to exfile().

  Probably ~30 LoC.

  Alan DeKok.