Re: [Clamav-users] clamd quit logging

2006-08-04 Thread Todd Lyons 
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

On Thu, Aug 03, 2006 at 06:09:25PM -0500, Chris wrote:

I was looking at my clamav stats file and noticed that it kept giving me the 
same amount of virus's detected as of 1 Aug. Looking  at 
my /var/log/clamav/clamd.log I noticed that it quit logging on Aug 1. I 
checked my syslog output and clamd has been running and I've been getting 
clamav hits on spam via the clamav plugin for spamassassin. Therefore 
everything is working. Any known reasons why clamd just up and quit 
logging?

Your logrotate program rotated the log out from under clamd and then
didn't HUP clamd to let it know that it needed to reopen logfiles.  Look
in /etc/logrotate.d/ and see what, if any, files reference the clamd
logfiles.  Here's what mine looks like on a Gentoo box.  It should be
similar to yours after you adjust for your paths:

smtp1 ~ # cat /etc/logrotate.d/freshclam 
/var/log/clamav/freshclam.log {
create 644 clamav clamav
monthly
compress
postrotate
/bin/killall -HUP freshclam
endscript
}
smtp1 ~ # cat /etc/logrotate.d/clamav 
/var/log/clamav/clamav.log {
create 644 clamav clamav
weekly
compress
postrotate
/bin/kill -HUP `cat /var/run/clamav/clamd.pid` 2/dev/null ||
true
endscript

}
- -- 
Regards...  Todd
Exponential problems need logarithmic solutions. --Eddy Dreger
Linux kernel 2.6.12-18mdksmp  11 users,  load average: 0.41, 0.30, 0.32
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.2.2 (GNU/Linux)

iD8DBQFE04FUY2VBGxIDMLwRAhqUAJ42AcWBkIEJGWb+KxKNL+71AIW+KACeLoK7
SpsPQpHpdHhgn6peDpAtkdI=
=s9f6
-END PGP SIGNATURE-
___
http://lurker.clamav.net/list/clamav-users.html

Re: [Clamav-users] clamd quit logging

2006-08-04 Thread Chris 
On Friday 04 August 2006 12:18 pm, Todd Lyons wrote:
 On Thu, Aug 03, 2006 at 06:09:25PM -0500, Chris wrote:
 I was looking at my clamav stats file and noticed that it kept giving me
  the same amount of virus's detected as of 1 Aug. Looking  at
 my /var/log/clamav/clamd.log I noticed that it quit logging on Aug 1. I
 checked my syslog output and clamd has been running and I've been
  getting clamav hits on spam via the clamav plugin for spamassassin.
  Therefore everything is working. Any known reasons why clamd just up
  and quit logging?

 Your logrotate program rotated the log out from under clamd and then
 didn't HUP clamd to let it know that it needed to reopen logfiles.  Look
 in /etc/logrotate.d/ and see what, if any, files reference the clamd
 logfiles.  Here's what mine looks like on a Gentoo box.  It should be
 similar to yours after you adjust for your paths:

Actually to keep my clamav stats continuous I removed (actually just moved 
it to another folder) the clamd logrotate script from /etc/logrotate.d.  
But the way I see it, if when the scripts in logrotate are run and the one 
for clamav isn't there then the log should continue on, or am I wrong here?

-- 
Chris
19:00:16 up 5 days, 28 min, 1 user, load average: 0.23, 0.17, 0.11



pgpIL8sOorH1e.pgp
Description: PGP signature
___
http://lurker.clamav.net/list/clamav-users.html

Re: [Clamav-users] clamd quit logging

2006-08-04 Thread Stephen Gran 
On Fri, Aug 04, 2006 at 07:07:25PM -0500, Chris said:
 On Friday 04 August 2006 12:18 pm, Todd Lyons wrote:
  On Thu, Aug 03, 2006 at 06:09:25PM -0500, Chris wrote:
  I was looking at my clamav stats file and noticed that it kept giving me
   the same amount of virus's detected as of 1 Aug. Looking  at
  my /var/log/clamav/clamd.log I noticed that it quit logging on Aug 1. I
 
 Actually to keep my clamav stats continuous I removed (actually just moved 
 it to another folder) the clamd logrotate script from /etc/logrotate.d.  
 But the way I see it, if when the scripts in logrotate are run and the one 
 for clamav isn't there then the log should continue on, or am I wrong here?

That seems like a bad idea.  First, look at LogFileMaxSize for why clamd
stopped writing to the log.  Then, teach your stats collector how to
keep state across log rotations.  Look at logtail if you want a good
implementation.
-- 
 --
|  Stephen Gran  |   The best cure for insomnia is to get  |
|  [EMAIL PROTECTED] | a lot of sleep. -W.C. Fields|
|  http://www.lobefin.net/~steve | |
 --


signature.asc
Description: Digital signature
___
http://lurker.clamav.net/list/clamav-users.html

Re: [Clamav-users] clamd quit logging

2006-08-04 Thread Chris 
On Friday 04 August 2006 7:59 pm, Stephen Gran wrote:

  Actually to keep my clamav stats continuous I removed (actually just
  moved it to another folder) the clamd logrotate script from
  /etc/logrotate.d. But the way I see it, if when the scripts in
  logrotate are run and the one for clamav isn't there then the log
  should continue on, or am I wrong here?

 That seems like a bad idea.  First, look at LogFileMaxSize for why clamd
 stopped writing to the log.  Then, teach your stats collector how to
 keep state across log rotations.  Look at logtail if you want a good
 implementation.

Thanks Stephen, I'll take a look at it.

-- 
Chris
20:13:02 up 5 days, 1:41, 1 user, load average: 0.22, 0.25, 0.27



pgpyw35iAoyzC.pgp
Description: PGP signature
___
http://lurker.clamav.net/list/clamav-users.html