Hi,
it seems there is a bug in newsyslog when using the monitor flag in
conjunction with a time specification. Files are only monitored if
they're about to getting rotated (time's up).
Given the following line in newsyslog.conf:
# Rotate every week on Monday at 00:00 hr
/var/log/authlog root:wheel 640 7 * $W1 ZM root
and the following lines in root's crontab:
# Rotate log files every hour expect midnight
0 1-23 * * * /usr/bin/newsyslog
# Monitor and rotate log files at midnight
0 0 * * * /usr/bin/newsyslog -m; /usr/bin/newsyslog
I found that my logfile only got monitored once a week just before it
got trimmed instead of every midnight (given there were changes in the
logfile, of course).
I suspect this is because of lines 323 - 328 in newsyslog.c which are
always evaluated until the file needs actual trimming. Because of the
return, domonitor() in line 338 is not reached.
Please see attached a proposal patch. I must admit that I'm a C novice,
but it seems to fix the problem and doesn't introduce others. This patch
also adjusts the verbose output a little, so it matches the other
formats (eg. when rotating by size or interval).
Regards
André
Index: newsyslog.c
===================================================================
RCS file: /cvs/src/usr.bin/newsyslog/newsyslog.c,v
retrieving revision 1.91
diff -u -r1.91 newsyslog.c
--- newsyslog.c 5 Apr 2013 01:29:07 -0000 1.91
+++ newsyslog.c 4 Mar 2014 18:55:25 -0000
@@ -295,6 +295,7 @@
{
struct stat sb;
int modhours;
+ int notrim = 0;
off_t size;
if (lstat(ent->log, &sb) != 0)
@@ -323,11 +324,11 @@
if (ent->flags & CE_TRIMAT && !force) {
if (timenow < ent->trim_at ||
difftime(timenow, ent->trim_at) >= 60 * 60) {
- DPRINTF(("--> will trim at %s",
+ DPRINTF(("will trim at %.24s ",
ctime(&ent->trim_at)));
- return;
+ notrim = 1;
} else if (ent->hours <= 0) {
- DPRINTF(("--> time is up\n"));
+ DPRINTF(("time is up\n"));
}
}
if (ent->size > 0)
@@ -337,7 +338,7 @@
DPRINTF(("age (hr): %d [%d] ", modhours, ent->hours));
if (monitormode && (ent->flags & CE_MONITOR) && domonitor(ent))
DPRINTF(("--> monitored\n"));
- else if (!monitormode &&
+ else if (!monitormode && !notrim &&
(force || (ent->size > 0 && size >= ent->size) ||
(ent->hours <= 0 && (ent->flags & CE_TRIMAT)) ||
(ent->hours > 0 && (modhours >= ent->hours || modhours < 0)
