For my purposes of creating readable, buffered logs in bite-sized chunks, Log Weaver pretty ideally performs the task. I wonder if you could just adapt Log Weaver such that it deletes the older production logs from the application server after it has finished consolidating them into the unified log? Do you have enough disk space for one day’s worth of production logs? That would probably be a 10 minute adaptation to the rake file, rather than the fairly complicated exercise of mashing together scattered Syslog-ng output into something readable.

Will be curious to hear what you end up with either way! Thanks for commenting.

That aside, I’m pretty sure you could implement most of Log Weaver’s functionality using a bit of syslog-ng-fu. On each app server, you can filter to an appropriate destination in the file system (ie /path/to/deploy/log/production.lg). Then on the centralized server, you can filter the incoming logs to a logfile which includes the app server’s hostname in addition to a unified log.

Like I said, hadn’t tried implementing it yet, but will try to report back if I do.

And I give it that endorsement even as there are a handful of issues that I’ve lobbied the Rubymine creators to tweak around. Even with some imperfections here and there, Rubymine is still the best Ruby GUI I’ve ever used by a factor of… lots. (For perspective: I think Visual Studio is the second best GUI I’ve used, though it’s pretty weak when it comes to Ruby, even with using Ruby in Steel)

Is Rubymine on Linux reliable?