I had noticed the same thing and with the RPM that I had created for syslog-ng, I modified the logrotate file for the user. Richard

-----Original Message----- From: syslog-ng-admin@lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of seberino@spawar.navy.mil Sent: Monday, April 07, 2003 4:52 PM To: Jacob Steinberger Cc: syslog-ng@lists.balabit.hu Subject: Re: [syslog-ng]logrotate question (not working with syslog-ng)...

Thanks!!!

I did not touch logrotate conf file. I just swapped syslog with syslog-ng and hoped nothing would break.

This is a really bad gotcha because I would guess lotsa of people will make this mistake.

Is there no way to make syslog-ng NOT require modification of logrotate? Do most people on this list know that? I hope so.

Chris

On Mon, Apr 07, 2003 at 06:27:10PM -0400, Jacob Steinberger wrote:

...

In your logrotate settings, did you send a restart to syslog-ng or a HUP to it? You need to do one of the two because the INODE on the file changes and syslog-ng isn't built to follow INODEs...

Jacob

...

For some reason every time logrotate rotates /var/log/messages, my syslog-ng stops working.

The permissions look ok..

[office root /var/log] # ls -l mess* -rw------- 1 root root 0 Apr 6 04:02 messages -rw------- 1 root root 378135 Apr 7 15:15 messages.1 -rw------- 1 root root 908864 Mar 31 15:50 messages.2 -rw------- 1 root root 1795514 Mar 25 14:06 messages.3 -rw------- 1 root root 945373 Mar 19 11:31 messages.4 -rw------- 1 root root 7 Apr 7 14:24 messages.offset

Why does logrotate cause syslog-ng to not put any new stuff in /var/log/messages?

Chris

-- _______________________________________

Dr. Christian Seberino SPAWAR Systems Center San Diego Code 2872 49258 Mills Street, Room 158 San Diego, CA 92152-5385 U.S.A.

Phone: (619) 553-9973 Fax: (619) 553-6521 Email: seberino@spawar.navy.mil _______________________________________ _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

--

_______________________________________

Dr. Christian Seberino SPAWAR Systems Center San Diego Code 2872 49258 Mills Street, Room 158 San Diego, CA 92152-5385 U.S.A.

Phone: (619) 553-9973 Fax: (619) 553-6521 Email: seberino@spawar.navy.mil _______________________________________ _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/sysl> og-ng

Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

Frank I like your solution. Can I ask you a question about it?? Why does it work??? Chris On Tue, Apr 08, 2003 at 11:01:17AM +1000, Frank Crawford wrote:

If you don't wish to modify the logrotate file, the other option is to startup syslog-ng with the '-p' option to name the pid file as syslog would, i.e. "syslog-ng -p /var/run/syslogd.pid".

Frank

On Tue, 2003-04-08 at 10:35, Richard E. Perlotto II wrote:

...

I had noticed the same thing and with the RPM that I had created for syslog-ng, I modified the logrotate file for the user.

Richard

...

-----Original Message----- From: syslog-ng-admin@lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of seberino@spawar.navy.mil Sent: Monday, April 07, 2003 4:52 PM To: Jacob Steinberger Cc: syslog-ng@lists.balabit.hu Subject: Re: [syslog-ng]logrotate question (not working with syslog-ng)...

Thanks!!!

I did not touch logrotate conf file. I just swapped syslog with syslog-ng and hoped nothing would break.

This is a really bad gotcha because I would guess lotsa of people will make this mistake.

Is there no way to make syslog-ng NOT require modification of logrotate? Do most people on this list know that? I hope so.

Chris

On Mon, Apr 07, 2003 at 06:27:10PM -0400, Jacob Steinberger wrote:

...

In your logrotate settings, did you send a restart to syslog-ng or a HUP to it? You need to do one of the two because the INODE on the file changes and syslog-ng isn't built to follow INODEs...

Jacob

...

For some reason every time logrotate rotates /var/log/messages, my syslog-ng stops working.

The permissions look ok..

[office root /var/log] # ls -l mess* -rw------- 1 root root 0 Apr 6 04:02 messages -rw------- 1 root root 378135 Apr 7 15:15 messages.1 -rw------- 1 root root 908864 Mar 31 15:50 messages.2 -rw------- 1 root root 1795514 Mar 25 14:06 messages.3 -rw------- 1 root root 945373 Mar 19 11:31 messages.4 -rw------- 1 root root 7 Apr 7 14:24 messages.offset

Why does logrotate cause syslog-ng to not put any new stuff in /var/log/messages?

Chris

-- _______________________________________

Dr. Christian Seberino SPAWAR Systems Center San Diego Code 2872 49258 Mills Street, Room 158 San Diego, CA 92152-5385 U.S.A.

Phone: (619) 553-9973 Fax: (619) 553-6521 Email: seberino@spawar.navy.mil _______________________________________ _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

--

_______________________________________

Dr. Christian Seberino SPAWAR Systems Center San Diego Code 2872 49258 Mills Street, Room 158 San Diego, CA 92152-5385 U.S.A.

Phone: (619) 553-9973 Fax: (619) 553-6521 Email: seberino@spawar.navy.mil _______________________________________ _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/sysl> og-ng

Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

-- ac3 Suite G16, Bay 7, Locomotive Workshop Phone: 02 9209 4600 Australian Technology Park Fax: 02 9209 4611 Eveleigh NSW 1430

_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

-- _______________________________________ Dr. Christian Seberino SPAWAR Systems Center San Diego Code 2872 49258 Mills Street, Room 158 San Diego, CA 92152-5385 U.S.A. Phone: (619) 553-9973 Fax: (619) 553-6521 Email: seberino@spawar.navy.mil _______________________________________

Frank So you are saying that logrotate *already* does a HUP but the problem is that it is "HUP-ing" based on /var/run/syslogd.pid??? Is this a new way to not only avoid modifying logrotate but also avoid -p switch!?!?!?!?!..... I can just make a soft link from /var/run/syslogd.pid to /var/run/syslogd-ng.pid!!! This is an even neater solution. Chris On Thu, Apr 10, 2003 at 11:10:13AM +1000, Frank Crawford wrote:

The standard compile options for syslog-ng put the pid file (which just contains the process ID) into '/var/run/syslogd-ng.pid', but logrotate and related things expect the pid to be in '/var/run/syslogd.pid', which is syslogd's standard location. Aside from the filename, syslogd and syslog-ng act the same on receipt of a SIGHUP (by design), and most apps just pick up the pid from that file.

Frank

On Thu, 2003-04-10 at 09:32, seberino@spawar.navy.mil wrote:

...

Frank

I like your solution. Can I ask you a question about it?? Why does it work???

Chris

On Tue, Apr 08, 2003 at 11:01:17AM +1000, Frank Crawford wrote:

...

If you don't wish to modify the logrotate file, the other option is to startup syslog-ng with the '-p' option to name the pid file as syslog would, i.e. "syslog-ng -p /var/run/syslogd.pid".

Frank

On Tue, 2003-04-08 at 10:35, Richard E. Perlotto II wrote:

...

I had noticed the same thing and with the RPM that I had created for syslog-ng, I modified the logrotate file for the user.

Richard

...

-----Original Message----- From: syslog-ng-admin@lists.balabit.hu [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of seberino@spawar.navy.mil Sent: Monday, April 07, 2003 4:52 PM To: Jacob Steinberger Cc: syslog-ng@lists.balabit.hu Subject: Re: [syslog-ng]logrotate question (not working with syslog-ng)...

Thanks!!!

I did not touch logrotate conf file. I just swapped syslog with syslog-ng and hoped nothing would break.

This is a really bad gotcha because I would guess lotsa of people will make this mistake.

Is there no way to make syslog-ng NOT require modification of logrotate? Do most people on this list know that? I hope so.

Chris

On Mon, Apr 07, 2003 at 06:27:10PM -0400, Jacob Steinberger wrote:

...

In your logrotate settings, did you send a restart to syslog-ng or a HUP to it? You need to do one of the two because the INODE on the file changes and syslog-ng isn't built to follow INODEs...

Jacob

> For some reason every time logrotate rotates /var/log/messages, my > syslog-ng stops working. > > The permissions look ok.. > > [office root /var/log] # ls -l mess* > -rw------- 1 root root 0 Apr 6 04:02 messages > -rw------- 1 root root 378135 Apr 7 15:15 messages.1 > -rw------- 1 root root 908864 Mar 31 15:50 messages.2 > -rw------- 1 root root 1795514 Mar 25 14:06 messages.3 > -rw------- 1 root root 945373 Mar 19 11:31 messages.4 > -rw------- 1 root root 7 Apr 7 14:24 messages.offset > > Why does logrotate cause syslog-ng to not put any new stuff in > /var/log/messages? > > Chris > > -- > _______________________________________ > > Dr. Christian Seberino > SPAWAR Systems Center San Diego > Code 2872 > 49258 Mills Street, Room 158 > San Diego, CA 92152-5385 > U.S.A. > > Phone: (619) 553-9973 > Fax: (619) 553-6521 > Email: seberino@spawar.navy.mil > _______________________________________ > _______________________________________________ > syslog-ng maillist - syslog-ng@lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/syslog-ng > Frequently asked questions at > http://www.campin.net/syslog-ng/faq.html

_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

--

_______________________________________

Dr. Christian Seberino SPAWAR Systems Center San Diego Code 2872 49258 Mills Street, Room 158 San Diego, CA 92152-5385 U.S.A.

Phone: (619) 553-9973 Fax: (619) 553-6521 Email: seberino@spawar.navy.mil _______________________________________ _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/sysl> og-ng

Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

-- ac3 Suite G16, Bay 7, Locomotive Workshop Phone: 02 9209 4600 Australian Technology Park Fax: 02 9209 4611 Eveleigh NSW 1430

_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

-- _______________________________________

Dr. Christian Seberino SPAWAR Systems Center San Diego Code 2872 49258 Mills Street, Room 158 San Diego, CA 92152-5385 U.S.A.

Phone: (619) 553-9973 Fax: (619) 553-6521 Email: seberino@spawar.navy.mil _______________________________________ -- ac3 Suite G16, Bay 7, Locomotive Workshop Phone: 02 9209 4600 Australian Technology Park Fax: 02 9209 4611 Eveleigh NSW 1430

-- _______________________________________ Dr. Christian Seberino SPAWAR Systems Center San Diego Code 2872 49258 Mills Street, Room 158 San Diego, CA 92152-5385 U.S.A. Phone: (619) 553-9973 Fax: (619) 553-6521 Email: seberino@spawar.navy.mil _______________________________________

Nate Why didn't you just modify the logrotate script for syslog?... else how is your own script called when a rotation happens? Chris On Wed, Apr 09, 2003 at 08:27:09PM -0700, nate wrote:

...

Frank

So you are saying that logrotate *already* does a HUP but the problem is that it is "HUP-ing" based on /var/run/syslogd.pid???

Is this a new way to not only avoid modifying logrotate but also avoid -p switch!?!?!?!?!.....

I can just make a soft link from /var/run/syslogd.pid to /var/run/syslogd-ng.pid!!!

This is an even neater solution.

I restart it manually with a script that runs after logrotate(not called from within logrotate):

#!/usr/local/bin/bash PID="`/usr/local/bin/pidof syslog-ng`"

/usr/bin/logger "SYSLOG-RESTART Script(/usr/local/sbin/syslog-restart.sh): Shutting Down syslog-ng(PID: $PID) .." /bin/kill $PID /usr/local/sbin/syslog-ng PID="`/usr/local/bin/pidof syslog-ng`" /usr/bin/logger "SYSLOG-RESTART Script(/usr/local/sbin/syslog-restart.sh): Starting up syslog-ng(NEW PID: $PID).."

works well for me ..logrotate on my systems(freebsd) never did seem to -HUP syslog-ng by itself(whenever logs got rotated, all new entries would end up in messages.* files instead of the filtered log files), so I do it this way..

nate

_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

-- _______________________________________ Dr. Christian Seberino SPAWAR Systems Center San Diego Code 2872 49258 Mills Street, Room 158 San Diego, CA 92152-5385 U.S.A. Phone: (619) 553-9973 Fax: (619) 553-6521 Email: seberino@spawar.navy.mil _______________________________________

Nate, You need to add the option "sharedscripts", which only runs the script once for all the matches, e.g. the Red Hat syslog file is: /var/log/messages /var/log/secure /var/log/maillog /var/log/spooler /var/log/boot.log /var/log/cron { sharedscripts postrotate /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true endscript } BTW, I don't think this option was in the original logrotate, but I know it has been around for a while. I've seen it since at least Red Hat 7.1. Frank On Fri, 2003-04-11 at 01:18, nate wrote:

...

Nate

Why didn't you just modify the logrotate script for syslog?... else how is your own script called when a rotation happens?

I did originally call the script from the "postrotate" option within logrotate.. but that didn't work so hot, turns out the postrotate option is called after every log, so in my case /var/log-ng/* restarted syslog-ng about 30 times. I suppose I could create an entry for every log but that would mean more long term maintainence of the file for the new messages.* files that are from new hosts.

unless theres another way..

nate

_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

-- ac3 Suite G16, Bay 7, Locomotive Workshop Phone: 02 9209 4600 Australian Technology Park Fax: 02 9209 4611 Eveleigh NSW 1430

Frank Thanks. From your info it sounds like it would make more sense to just replace /etc/logrotate.d/syslog with a modified version *or* /etc/logrotate.d/syslog-ng if that would work. Chris On Thu, Apr 10, 2003 at 01:50:27PM +1000, Frank Crawford wrote:

Chris, First off, this is for Red Hat Linux 8.0, with logrotate 3.6.5, although I'm fairly sure it hasn't changed much for a long, long time.

The logrotate.conf file loads in a bunch of specific config files from the directory /etc/logrotate.d, including one specifically for syslog. The syslog config rotates all the standard log files for Red Hat Linux and then as a postrotate line of:

/bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true

and so just follows the file syslogd.pid.

So, to answer your questions, yes you can modify the syslogd file, but upgrades to logrotate may well put back the original file.

Secondly, putting in a soft link will work, but I've seen some cleanup scripts remove lots of things on boot (e.g. Solaris uses a memfs, so it all goes away anyway), and secondly, unless you remove the symlink file, it will be left pointing to nothing when syslog-ng is shutdown (since I think syslog-ng does remove it's pid file).

Frank

On Thu, 2003-04-10 at 12:35, seberino@spawar.navy.mil wrote:

...

Frank

So you are saying that logrotate *already* does a HUP but the problem is that it is "HUP-ing" based on /var/run/syslogd.pid???

Is this a new way to not only avoid modifying logrotate but also avoid -p switch!?!?!?!?!.....

I can just make a soft link from /var/run/syslogd.pid to /var/run/syslogd-ng.pid!!!

This is an even neater solution.

Chris

On Thu, Apr 10, 2003 at 11:10:13AM +1000, Frank Crawford wrote:

...

The standard compile options for syslog-ng put the pid file (which just contains the process ID) into '/var/run/syslogd-ng.pid', but logrotate and related things expect the pid to be in '/var/run/syslogd.pid', which is syslogd's standard location. Aside from the filename, syslogd and syslog-ng act the same on receipt of a SIGHUP (by design), and most apps just pick up the pid from that file.

Frank

On Thu, 2003-04-10 at 09:32, seberino@spawar.navy.mil wrote:

...

Frank

I like your solution. Can I ask you a question about it?? Why does it work???

Chris

On Tue, Apr 08, 2003 at 11:01:17AM +1000, Frank Crawford wrote:

...

If you don't wish to modify the logrotate file, the other option is to startup syslog-ng with the '-p' option to name the pid file as syslog would, i.e. "syslog-ng -p /var/run/syslogd.pid".

Frank

On Tue, 2003-04-08 at 10:35, Richard E. Perlotto II wrote:

...

I had noticed the same thing and with the RPM that I had created for syslog-ng, I modified the logrotate file for the user.

Richard

> -----Original Message----- > From: syslog-ng-admin@lists.balabit.hu > [mailto:syslog-ng-admin@lists.balabit.hu] On Behalf Of > seberino@spawar.navy.mil > Sent: Monday, April 07, 2003 4:52 PM > To: Jacob Steinberger > Cc: syslog-ng@lists.balabit.hu > Subject: Re: [syslog-ng]logrotate question (not working with > syslog-ng)... > > > Thanks!!! > > I did not touch logrotate conf file. I just swapped > syslog with syslog-ng and hoped nothing would break. > > This is a really bad gotcha because I would guess > lotsa of people will make this mistake. > > Is there no way to make syslog-ng NOT require modification > of logrotate? Do most people on this list know that? > I hope so. > > Chris > > > On Mon, Apr 07, 2003 at 06:27:10PM -0400, Jacob Steinberger wrote: > > In your logrotate settings, did you send a restart to > syslog-ng or a > > HUP to it? You need to do one of the two because the INODE > on the file > > changes and syslog-ng isn't built to follow INODEs... > > > > Jacob > > > > > For some reason every time logrotate rotates > /var/log/messages, my > > > syslog-ng stops working. > > > > > > The permissions look ok.. > > > > > > [office root /var/log] # ls -l mess* > > > -rw------- 1 root root 0 Apr 6 04:02 messages > > > -rw------- 1 root root 378135 Apr 7 15:15 messages.1 > > > -rw------- 1 root root 908864 Mar 31 15:50 messages.2 > > > -rw------- 1 root root 1795514 Mar 25 14:06 messages.3 > > > -rw------- 1 root root 945373 Mar 19 11:31 messages.4 > > > -rw------- 1 root root 7 Apr 7 14:24 > messages.offset > > > > > > Why does logrotate cause syslog-ng to not put any new stuff in > > > /var/log/messages? > > > > > > Chris > > > > > > -- > > > _______________________________________ > > > > > > Dr. Christian Seberino > > > SPAWAR Systems Center San Diego > > > Code 2872 > > > 49258 Mills Street, Room 158 > > > San Diego, CA 92152-5385 > > > U.S.A. > > > > > > Phone: (619) 553-9973 > > > Fax: (619) 553-6521 > > > Email: seberino@spawar.navy.mil > > > _______________________________________ > > > _______________________________________________ > > > syslog-ng maillist - syslog-ng@lists.balabit.hu > > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > > Frequently asked questions at > > > http://www.campin.net/syslog-ng/faq.html > > > > > > > > _______________________________________________ > > syslog-ng maillist - syslog-ng@lists.balabit.hu > > https://lists.balabit.hu/mailman/listinfo/syslog-ng > > Frequently asked questions at > http://www.campin.net/syslog-ng/faq.html > > -- > > _______________________________________ > > Dr. Christian Seberino > SPAWAR Systems Center San Diego > Code 2872 > 49258 Mills Street, Room 158 > San Diego, CA 92152-5385 > U.S.A. > > Phone: (619) 553-9973 > Fax: (619) 553-6521 > Email: seberino@spawar.navy.mil > _______________________________________ > _______________________________________________ > syslog-ng maillist - syslog-ng@lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/sysl> og-ng > > Frequently asked questions at > http://www.campin.net/syslog-ng/faq.html > > >

_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

-- ac3 Suite G16, Bay 7, Locomotive Workshop Phone: 02 9209 4600 Australian Technology Park Fax: 02 9209 4611 Eveleigh NSW 1430

_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

-- _______________________________________

Dr. Christian Seberino SPAWAR Systems Center San Diego Code 2872 49258 Mills Street, Room 158 San Diego, CA 92152-5385 U.S.A.

Phone: (619) 553-9973 Fax: (619) 553-6521 Email: seberino@spawar.navy.mil _______________________________________ -- ac3 Suite G16, Bay 7, Locomotive Workshop Phone: 02 9209 4600 Australian Technology Park Fax: 02 9209 4611 Eveleigh NSW 1430

-- _______________________________________

Dr. Christian Seberino SPAWAR Systems Center San Diego Code 2872 49258 Mills Street, Room 158 San Diego, CA 92152-5385 U.S.A.

Phone: (619) 553-9973 Fax: (619) 553-6521 Email: seberino@spawar.navy.mil _______________________________________ -- ac3 Suite G16, Bay 7, Locomotive Workshop Phone: 02 9209 4600 Australian Technology Park Fax: 02 9209 4611 Eveleigh NSW 1430

_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

-- _______________________________________ Dr. Christian Seberino SPAWAR Systems Center San Diego Code 2872 49258 Mills Street, Room 158 San Diego, CA 92152-5385 U.S.A. Phone: (619) 553-9973 Fax: (619) 553-6521 Email: seberino@spawar.navy.mil _______________________________________

On 2003-04-10 16:45:16 +1000, Frank Crawford wrote:

On Thu, 2003-04-10 at 16:40, seberino@spawar.navy.mil wrote:

...

Thanks. From your info it sounds like it would make more sense to just replace /etc/logrotate.d/syslog with a modified version *or* /etc/logrotate.d/syslog-ng if that would work.

The latter, I think. /etc/logrotate.d/syslog belongs to the sysklogd package and syslog-ng should be a replacement for sysklogd.

Yes, as long as there was only one file that referred to the log files. Otherwise both would try to rotate them and confuse most people later.

Right. However IMHO only one of the packages should be installed at any time (although I realize that some would like to use klogd with syslog-ng, but that's a different matter), so the "double rotation" shouldn't be a problem in a sane installation. Relying on the configuration file of an alternative package to provide log rotation seems much more problematic and confusing to me. hp -- _ | Peter J. Holzer | Latein ist das humanoide Äquivalent |_|_) | Sysadmin WSR | zu Fortran. | | | hjp@hjp.at | __/ | http://www.hjp.at/ | -- Alexander Bartolich in at.linux

Chris, Check that /etc/logrotate.conf has the line "include /etc/logrotate.d", which forces the include all files in the directory '/etc/logrotate.d'. That is the standard configuration for Red Hat for sometime now. I expect it to be so for other Linux distro's that implement the logrotate package. As to how it knows, it just runs every file in the logrotate.d directory (or more correctly includes them in the conf and then runs that). The match is made on the log filenames, and if they match then the block below is executed. The name of the config file you added doesn't matter to logrotate but it makes it a lot easier for humans if it does relate to the package or some other obvious standard. Frank On Fri, 2003-04-11 at 10:52, seberino@spawar.navy.mil wrote:

Frank

Can I ask you 1 last question? :)

I made a /etc/logrotate.d/syslog-ng and erased /etc/logrotate.d/syslog.

The only difference is the new guy works off /var/run/syslog-ng.pid rather than /var/run/syslog.pid.

Will logrotate run this file when it rotates syslog-ng files???

How does logrotate know to run this file?? I assume it expects a file whose name is the name of the daemon???

(If I called it /etc/logrotate.d/charlie it prolly would not have worked right?)

Chris

On Thu, Apr 10, 2003 at 04:45:16PM +1000, Frank Crawford wrote:

...

Chris, Yes, as long as there was only one file that referred to the log files. Otherwise both would try to rotate them and confuse most people later.

Frank

On Thu, 2003-04-10 at 16:40, seberino@spawar.navy.mil wrote:

...

Frank

Thanks. From your info it sounds like it would make more sense to just replace /etc/logrotate.d/syslog with a modified version *or* /etc/logrotate.d/syslog-ng if that would work.

Chris .... _______________________________________

Dr. Christian Seberino SPAWAR Systems Center San Diego Code 2872 49258 Mills Street, Room 158 San Diego, CA 92152-5385 U.S.A.

Phone: (619) 553-9973 Fax: (619) 553-6521 Email: seberino@spawar.navy.mil _______________________________________ -- ac3 Suite G16, Bay 7, Locomotive Workshop Phone: 02 9209 4600 Australian Technology Park Fax: 02 9209 4611 Eveleigh NSW 1430

-- _______________________________________

Dr. Christian Seberino SPAWAR Systems Center San Diego Code 2872 49258 Mills Street, Room 158 San Diego, CA 92152-5385 U.S.A.

Phone: (619) 553-9973 Fax: (619) 553-6521 Email: seberino@spawar.navy.mil _______________________________________ -- ac3 Suite G16, Bay 7, Locomotive Workshop Phone: 02 9209 4600 Australian Technology Park Fax: 02 9209 4611 Eveleigh NSW 1430

On Wed, Apr 09, 2003 at 11:40:34PM -0700, seberino@spawar.navy.mil wrote:

Thanks. From your info it sounds like it would make more sense to just replace /etc/logrotate.d/syslog with a modified version *or* /etc/logrotate.d/syslog-ng if that would work.

I use cfengine to modify log rotation scripts and keep them modified correctly, /etc/logrotate.d/syslog on redhat, /usr/lib/newsyslog on solaris <= 8 (forget offhand the config for the cool new rotation tool on sol9, but I do that one too), and on debian I just 'apt-get install syslog-ng' once at install time ;) Make sure that whatever you use to modify your log rotation scripts *keeps* them updated over time despite updates/upgrades/patches. -- Nate Campi http://www.campin.net

Oh one more thing. There was an old email in archive about similar problems writing to dhcp log file. The answer there was his libol version was too low. I'm using old redhat7.3 and installed newest syslog-ng from source..... is it possible even redhat7.3 is too old for syslog-ng source??? Perhaps a little libol upgrade would fix?? I dunno why newer libol version would negate need for HUP but who knows. Chris On Mon, Apr 07, 2003 at 06:27:10PM -0400, Jacob Steinberger wrote:

In your logrotate settings, did you send a restart to syslog-ng or a HUP to it? You need to do one of the two because the INODE on the file changes and syslog-ng isn't built to follow INODEs...

Jacob

...

For some reason every time logrotate rotates /var/log/messages, my syslog-ng stops working.

The permissions look ok..

[office root /var/log] # ls -l mess* -rw------- 1 root root 0 Apr 6 04:02 messages -rw------- 1 root root 378135 Apr 7 15:15 messages.1 -rw------- 1 root root 908864 Mar 31 15:50 messages.2 -rw------- 1 root root 1795514 Mar 25 14:06 messages.3 -rw------- 1 root root 945373 Mar 19 11:31 messages.4 -rw------- 1 root root 7 Apr 7 14:24 messages.offset

Why does logrotate cause syslog-ng to not put any new stuff in /var/log/messages?

Chris

-- _______________________________________

Dr. Christian Seberino SPAWAR Systems Center San Diego Code 2872 49258 Mills Street, Room 158 San Diego, CA 92152-5385 U.S.A.

Phone: (619) 553-9973 Fax: (619) 553-6521 Email: seberino@spawar.navy.mil _______________________________________ _______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html

-- _______________________________________ Dr. Christian Seberino SPAWAR Systems Center San Diego Code 2872 49258 Mills Street, Room 158 San Diego, CA 92152-5385 U.S.A. Phone: (619) 553-9973 Fax: (619) 553-6521 Email: seberino@spawar.navy.mil _______________________________________