Truncate /var/log/syslog, or read from end? about geoip-attack-map HOT 3 OPEN

I liked the second option

from geoip-attack-map.

I like the first, truncate the syslog when run DataServer.py once time.
And I also do that.
The syslog.py can run all the time, even restart DataServer.py several times.
And if never truncate the syslog,it will be bigger and bigger.

from geoip-attack-map.

The log files should not be modified in my opinion. Better work on the application so it reads only the new data and not from start to finish how it is done. Another interesting option I make here is to transfer the log that arrives in syslog to a specific file. This makes things easier because it does not mix attack logs with system logs, access, etc ... It is possible by editing the configuration file of your log system and put something like this:

if $fromhost-ip startswith '192.168.0.2' then /var/log/snort.log

from geoip-attack-map.