On Monday 16 November 2009 17:55:51 Eray Aslan wrote:
> On 16.11.2009 14:46, Neil Bothwick wrote:
> > On Mon, 16 Nov 2009 09:05:18 +0200, Eray Aslan wrote:
> >> - No need to logrotate with time based filenames. Hence, no need to
> >> "kill -HUP" the syslog daemon. No missed logs.
> >
> > Then how do you get the server to use the new logfile names each
> > day/week?
>
> It creates and uses a new file each hour/day/etc. Perhaps, you missed
> the file(...) directive? Reposting for your reference:
>
> destination mail {
> file("/var/log/mail/$YEAR/$MONTH/$DAY/$HOUR"
> [...]
>
> > You only need to send a SIGHUP to the server using that log
> > facility, so syslog would not be affected in your example.
>
> I can't parse this. The point is avoiding SIGHUP so that we do not miss
> any log messages.
>
> OP asked how one manages log files without logrotate and the answer is
> with time based file names. It has the additional benefit of avoiding
> SIGHUP.
>
I have three machines that randomly kill syslog or syslog-ng as appropriate
whenever they feel like it on daily rotates. There's no warning, no evidence,
they just ... die. 5 minutes later nagios goes ballistic and I have work to
do. That all three are SuSE machines is probably highly relevant.
So, anything that syslog-ng can do itself without needing external
intervention is a very good thing. I can then compress and move the closed
files around later at my leisure in complete safety.
--
alan dot mckinnon at gmail dot com
