Ahh.... you learn something new everyday :) BTW: a nice way to find the hardlink(s) and original file . "find * -xdev -samefile alerts.log"
results in: 2011/Dec/ossec-alerts-15.log alerts.log On Thu, Dec 15, 2011 at 2:42 PM, dan (ddp) <[email protected]> wrote: > # ls -li /var/ossec/logs/alerts/alerts.log > /var/ossec/logs/alerts/2011/Dec/ossec-alerts-15.log > 3560186 -rw-r----- 2 ossec ossec 486054 Dec 15 17:41 > /var/ossec/logs/alerts/2011/Dec/ossec-alerts-15.log > 3560186 -rw-r----- 2 ossec ossec 486054 Dec 15 17:41 > /var/ossec/logs/alerts/alerts.log > > > (hardlink ;)) > > On Thu, Dec 15, 2011 at 5:36 PM, jplee3 <[email protected]> wrote: > > Hey all, > > > > I just realized, at least it appears this way, that alerts.log is a > > 'duplicate' of the nested ossec-alerts-XX.log. Is there a reason why? > > Why couldn't alerts.log just be a symlink of the ossec-alerts-XX.log? >
