On 2020-11-28, Jan Stary <h...@stare.cz> wrote: > If I'm reading you right, the rotation sends a SIGHUP to each > of the pflogd processes; twice, in fact: after rotating each > of the two files. Is that the case?
Yes, you have the same command for restarting pflogd on both newsyslog.conf lines so it will send signals to both daemons twice in short succession. I don't know if that will cause corruption (maybe pflogd doesn't care if it gets two signals in short succession) but it's clearly not ideal. > That would indeed be a problem; namely, it would break the nice > sequence of one rotated logfile per day. The rotation is done by newsyslog (once per file) so the sequence would still work. > If I read the newsyslog lines right, each of > > 13680 pflogd: [running] -s 1500 -i pflog0 -f /var/log/pflog > 84985 pflogd: [priv] > 10562 pflogd: [running] -s 1500 -i pflog1 -f /var/log/siplog > 94396 pflogd: [priv] > > is getting HUP'd, right? Only the priv processes are sent HUP. > Would it be enough to HUP the [running] child? no idea, but someone obviously went to the trouble to make it signal only the priv process so there's probably a reason for this. > |-+= 84985 root pflogd: [priv] (pflogd) > | \--- 13680 _pflogd pflogd: [running] -s 1500 -i pflog0 -f /var/log/pflog > (pflogd) > > |-+= 94396 root pflogd: [priv] (pflogd) > | \--- 10562 _pflogd pflogd: [running] -s 1500 -i pflog1 -f /var/log/siplog > (pflogd) > > Probably not, based on what you said about [priv]; but the [running] > processes can be distinguished in newsyslog.conf with "pkill -xf pflog0". yes those are easy to differentiate :)
