Re: Log archiving question

2008-01-05 Thread Matthew Seaman
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Walt Pawley wrote:

 I've had no difficulties with the change made on my Mac OS X
 Jaguar system - if it affects something, the something is
 something I apparently don't do. So, all that preamble brings
 me to my question. Are there things that modifying the archived
 log data file names would interfere with?

There shouldn't be -- the archived log files are only there for
reference.  Any live logging action should go to the base (unnumbered)
log file.

However, it is possible to get into a state where a program is 
logging to a file that has no directory entry -- the symptoms there
tend to be /var filling up according to df(1) but with plenty of
space left according to du(1).  That happens when the process doing
the logging does not get signalled to close and reopen the log file
- -- newsyslog will signal processes for you, but it defaults to
signalling syslogd in the absence of any other instructions.

Cheers,

Matthew

- -- 
Dr Matthew J Seaman MA, D.Phil.   7 Priory Courtyard
  Flat 3
PGP: http://www.infracaninophile.co.uk/pgpkey Ramsgate
  Kent, CT11 9PW
-BEGIN PGP SIGNATURE-
Version: GnuPG v2.0.4 (FreeBSD)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFHf2Yt8Mjk52CukIwRCLfoAJ91oGyEKOsXtgwdBq8RoOyfx8+f4gCgiQQA
cAQWIYASzkgVf0MZRJoAnV8=
=QYkv
-END PGP SIGNATURE-
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]


Log archiving question

2008-01-04 Thread Walt Pawley
Once upon a time I messed with FreeBSD rather frequently. Then
things changed. Time passed and I'm back to tinkering with
things a little, though mostly from the perspective of a Mac OS
X user. In that distant past, I found that rotating log files
in the classical manner - changing the number and dropping any
log needing another digit - did not preserve data that was
needed to work on some of the problems we were seeing. So, I
changed the way rotating was done to never delete the logs in
question, instead naming the archived file uniquely with a time
code. Here's an example of such a modification for Mac OS X
Jaguar (a bit out of date but I use it 24/7) to deal with its
equivalent of /var/log/messages. It's offered just to show the
nature of the results.

--

echo 
echo -n Rotating log files:0
cd /var/log
for i in system.log; do
if [ -f ${i} ]; then
echo -n  ${i}
if [ -x /usr/bin/gzip ]; then gzext=.gz; else gzext=; fi
if [ -f ${i}.6${gzext} ]; then mv -f ${i}.6${gzext}
${i}.7${gzext}; fi
if [ -f ${i}.5${gzext} ]; then mv -f ${i}.5${gzext}
${i}.6${gzext}; fi
if [ -f ${i}.4${gzext} ]; then mv -f ${i}.4${gzext}
${i}.5${gzext}; fi
if [ -f ${i}.3${gzext} ]; then mv -f ${i}.3${gzext}
${i}.4${gzext}; fi
if [ -f ${i}.2${gzext} ]; then mv -f ${i}.2${gzext}
${i}.3${gzext}; fi
if [ -f ${i}.1${gzext} ]; then mv -f ${i}.1${gzext}
${i}.2${gzext}; fi
if [ -f ${i}.0${gzext} ]; then mv -f ${i}.0${gzext}
${i}.1${gzext}; fi
#   if [ -f ${i} ]; then mv -f ${i} ${i}.0  if [ -x
/usr/bin/gzip ]; then gzip -9 ${i}.0; fi; fi
#   touch ${i}  chmod 640 ${i}  chown root:admin ${i}
# 23 Sep 2007 1342
# Modification to keep system.log files by date rather than rotating them
# NOTE: no provision for deleting the accumulation is provided
X=$(date|awk '{print 0$3$2$6}')
X=${i}.${X:0-9}
mv -f ${i} ${X}
touch ${i}  chmod 640 ${i}  chown root:admin ${i}
if [ -x /usr/bin/gzip ]; then gzip -9 ${X}; fi
fi
done
if [ -f /var/run/syslog.pid ]; then kill -HUP $(cat
/var/run/syslog.pid | head -1); fi
echo 

--

Since I recently set up a PCBSD 1.4.1 machine to play with, I
see that log rotation is no longer done with scripts but
rather with newsyslog. If I read the man page correctly,
newsyslog rotates the log files in the good old way though it
seems to have a much more comprehensive approach as to when to
do it.

I've had no difficulties with the change made on my Mac OS X
Jaguar system - if it affects something, the something is
something I apparently don't do. So, all that preamble brings
me to my question. Are there things that modifying the archived
log data file names would interfere with?
-- 

Walter M. Pawley [EMAIL PROTECTED]
Wump Research  Company
676 River Bend Road, Roseburg, OR 97470
 541-672-8975
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]