A number of people have reported experiencing syslog rotate failures. The code that does log rotation, should be separate from the code that does log file compression. Quick log rotation w/out compression reduces the CPU and I/O load on the system during a time when it is most important. This reduces the race window for processes not responding to signals like SIGHUP. The current code sends a HUP signal, and assumes that sysklogd receives it immediately. Additionally, log messages are lost during the window between when compression starts and the logging process receives its signal. It is fundamentally flawed to compress a log file that is current live and open for writing.
The savelog program acknowledges this: # Bugs: If a process is still writing to the file.0 and savelog # moved it to file.1 and compresses it, data could be lost. # Smail does not have this problem in general because it # restats files often. MrC -- syslog does not restart after rotating logfile https://launchpad.net/bugs/49165 -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
