Actually it is pretty simple:
This is my C File called Logging.c It's pretty simple.

#include <syslog.h>
#include <stdio.h>

#include "Logging.h"


void initLog()
{
openlog("qtella logging", LOG_PID, LOG_LOCAL0);
}

void logEntry(const char* message)
{
syslog (LOG_NOTICE, message);
}

void closeLog()
{
closelog();
}


I suggest you read the manpages for:

syslog
syslog.conf

They are very good.

So before you log something call openLog() when you are done closeLog().

To log data call logEntry(const char* message). If you want you can add more parameters to the function call eg. the severity level (LOG_NOTICE).

To include the file in C++ you have to use

extern "C" {
#include "Logging.h"
}

That's it ... for C/C++

To store the data to a file you have to open syslog.conf usually located in /etc/ and add something like:
local0.* /var/log/qtella.log
if you used LOG_LOCAL0 to open syslog.

Then restart syslog or use the SIGHUP signal to reread the conf file.

All done now


Hard to tell but you can calculate: Take the biggest paket size (I guess query Hit?) with some hits (5?) and add some bytes for the syslog data that come first in the file (about 50 bytes per entry)and check how many packets you receive in one hour then you can calculate...

As far as I know syslog creates a new file if the old one gets too big but I don't know at which file size this happens...