1 files changed, 87 insertions, 6 deletions

diff --git a/src/util.h b/src/util.h
index d72518b..dfe7511 100644
--- a/src/util.h
+++ b/src/util.h
@@ -87,6 +87,15 @@ inline T& REF(const T& val)
 
 extern bool fDebug;
 
+// /debugrelay: the per-message firehose ("relay" and "nostrdiscovery"
+// categories) that even -debug keeps off. See LogAcceptsCategory().
+extern bool fDebugRelay;
+
+// debug.log is rolled to debug.log.old once it grows past this many bytes
+// (set from -maxdebugfilesize, in MB; 0 disables the check). See the roll
+// site in OutputDebugStringF() below.
+extern int64 nMaxDebugFileSize;
+
 // ---------------------------------------------------------------------------
 // Categorized, burst-collapsing logging
 //
@@ -106,15 +115,29 @@ extern bool fDebug;
 //   2. Burst collapse: repeated LogPrint() calls from the *same source line*
 //      only emit one line per DEDUP_WINDOW_SECS; if more calls land inside
 //      that window they're counted instead of reprinted, and the count is
-//      flushed as a single "(xN similar in Ws)" line the moment the window
-//      rolls over. A loop discovering 500 peers by address now produces a
-//      small, bounded number of lines instead of 500 -- log growth is capped
-//      by elapsed time, not by how many similar events happen to fire.
+//      flushed as a single "(xN similar in Ws)" line once the window expires
+//      -- whether or not that call site ever fires again. A loop discovering
+//      500 peers by address now produces a small, bounded number of lines
+//      instead of 500 -- log growth is capped by elapsed time, not by how
+//      many similar events happen to fire.
+//
+// Use LogPrintAlways() instead for anything that reports an irreversible
+// change to money: an obligation voided, a payment sent, a payment that
+// failed. One line standing in for an unknown number of identical events is
+// a tidy report of peer chatter and a false report of a ledger. A reorg
+// voiding 100 entries hits one source line 100 times inside one window;
+// under LogPrint() that read as a single block losing a single 49.49 BTF
+// payment, while 4,950 BTF of obligations were actually destroyed, and the
+// discrepancy was only found by counting entries in pending_payouts.json
+// (issue #3). Bounded log growth is not worth that ambiguity here.
 // ---------------------------------------------------------------------------
 bool LogAcceptsCategory(const char* category);
 void LogPrintDedup(const char* category, const char* file, int line, const std::string& msg);
+void LogPrintNoCollapse(const char* category, const std::string& msg);
 #define LogPrint(category, ...) \
     do { if (LogAcceptsCategory(category)) LogPrintDedup((category), __FILE__, __LINE__, strprintf(__VA_ARGS__)); } while (0)
+#define LogPrintAlways(category, ...) \
+    do { if (LogAcceptsCategory(category)) LogPrintNoCollapse((category), strprintf(__VA_ARGS__)); } while (0)
 
 // Every format string in this project goes through one of the four functions
 // below -- `printf` itself is remapped to OutputDebugStringF just above, and
@@ -145,7 +168,7 @@ void ParseString(const string& str, char c, vector<string>& v);
 string FormatMoney(int64 n, bool fPlus=false);
 bool ParseMoney(const char* pszIn, int64& nRet);
 bool FileExists(const char* psz);
-int GetFilesize(FILE* file);
+int64 GetFilesize(FILE* file);
 uint64 GetRand(uint64 nMax);
 int64 GetTime();
 int64 GetAdjustedTime();
@@ -199,7 +222,7 @@ protected:
 public:
     char* pszFile;
     int nLine;
-    explicit CCriticalSection() { InitializeCriticalSection(&cs); }
+    explicit CCriticalSection() : pszFile(NULL), nLine(0) { InitializeCriticalSection(&cs); }
     ~CCriticalSection() { DeleteCriticalSection(&cs); }
     void Enter() { EnterCriticalSection(&cs); }
     void Leave() { LeaveCriticalSection(&cs); }
@@ -390,7 +413,65 @@ inline int OutputDebugStringF(const char* pszFormat, ...)
             else
                 strDebugFile = "debug.log";
         }
+        // Latched by a failed rename in the roll below, which cannot be
+        // retried usefully and must not be retried endlessly.
+        static bool fRollDisabled = false;
         FILE* fileout = fopen(strDebugFile.c_str(), "a");
+        if (fileout && nMaxDebugFileSize > 0 && !fRollDisabled)
+        {
+            // Roll an overgrown debug.log before adding to it. Nothing in the
+            // tree shrinks this file once the process is running (there is no
+            // ShrinkDebugFile, and even Bitcoin's only ran at startup), so a
+            // node that stays up for months grows the log without bound --
+            // production hit ~2 GiB. The file is opened and closed per line,
+            // so a rename is safe here: the next line simply reopens the
+            // path. One generation is kept as debug.log.old; logrotate
+            // (contrib/logrotate/) handles anything longer-term.
+            int64 nSize = GetFilesize(fileout);
+            if (nSize >= 0 && nSize > nMaxDebugFileSize)
+            {
+                fclose(fileout);
+                string strOldFile = strDebugFile + ".old";
+                remove(strOldFile.c_str()); // rename() won't clobber on Windows
+                bool fRolled = (rename(strDebugFile.c_str(), strOldFile.c_str()) == 0);
+                int nRenameErrno = errno; // before fopen() can overwrite it
+                fileout = fopen(strDebugFile.c_str(), "a");
+                if (fRolled)
+                {
+                    if (fileout)
+                        fprintf(fileout,
+                            "debug.log grew past %lld MB; previous contents moved to debug.log.old (-maxdebugfilesize)\n",
+                            (long long)(nMaxDebugFileSize / 1024 / 1024));
+                }
+                else if (nRenameErrno == ENOENT)
+                {
+                    // The file went away between the size check and the
+                    // rename, so an external rotator (logrotate) got there
+                    // first. Nothing left to roll and nothing wrong: the
+                    // fopen above has already recreated it. Latching on this
+                    // would let a benign race with logrotate switch the cap
+                    // off for the rest of the run.
+                }
+                else
+                {
+                    // The file is still over the cap, so this branch would be
+                    // reached again on the next line and every line after it.
+                    // Unlatched, the complaint about failing to roll becomes
+                    // the runaway growth the roll exists to prevent. Say it
+                    // once and stop trying -- on stderr too, because whatever
+                    // blocked the rename (read-only mount, permissions, EXDEV
+                    // across a bind mount) may equally block the log write.
+                    fRollDisabled = true;
+                    fprintf(stderr,
+                        "cannot roll %s (rename to .old failed: %s); -maxdebugfilesize disabled for this run\n",
+                        strDebugFile.c_str(), strerror(nRenameErrno));
+                    if (fileout)
+                        fprintf(fileout,
+                            "cannot roll debug.log (rename to .old failed: %s); -maxdebugfilesize disabled for this run\n",
+                            strerror(nRenameErrno));
+                }
+            }
+        }
         if (fileout)
         {
             va_list arg_ptr;