Re: Problem with logcheck
On Thu, 08 Aug 2002 21:51:18 -0400,
Hubert Chan <hubert@uhoreg.ca> wrote:
> I'm not sure who's at fault here, but I found that /var/log contained
> many old log files, with a ".0" extension, which I believe got there
> when changing system loggers, causing logrotate's configuration to
> change. After deleting those (note: not all .0 files are bad; check the
> date), everything worked fine.
The problem is that savelog begins its suffix with 0 while logrotate
begins its suffix with 1. logcheck has a crude hack to support them:
if the log file is shorter than it was, then:
if there is logfile.0, assume that it was rotated by savelog and read it
else, if there is logfile.1, assume that it was rotated by logrotate
If you switch from savelog to logrotate and leave logfile.0,
logcheck will read it every time the log file is rotated.
--
Oohara Yuuma <oohara@libra.interq.or.jp>
Debian developer
PGP key (key ID F464A695) http://www.interq.or.jp/libra/oohara/pub-key.txt
Key fingerprint = 6142 8D07 9C5B 159B C170 1F4A 40D6 F42E F464 A695
Better just encrypt it all in your head :-).
--- Derrick 'dman' Hudson, about encryption without any physical medium
Reply to: