syslog-ng and size based logrotate

[xavier <list.debian-user@natch.dyndns.org>]

Hi,


I setted up my workstation
to logrotate logs based on size.

thoses entries are in  /etc/logrotate.d/syslog-ng  :

[...]

/var/log/ppp.log {
   rotate 20
   size=10M
   missingok
   notifempty
   compress
}


[...]

/var/log/syslog {
   rotate 20
   size=10M
   compress
   postrotate
      /etc/init.d/syslog-ng reload >/dev/null
   endscript
}



so, in /var/log/syslog, daily is replaced by size=10M.

which means the postrotate script will be executed 
only when syslog reach 10M.

the side effect is that if another log grows faster
than  syslog (for example i have a catchall log *.* to all.log),
all.log may be rotated, and syslog, which is still < 10M,
wont be rotated.

so syslog-ng will continue to log to all.log.1 
annoying.

however, this is rarely the case ;
even if you set everything to logrotate based on size,
syslog has good chances to be the biggest, due to 
the partial catch all.

in a normal debian install, this is never the case;
the script is executed daily, because the log rotation
is set so.

there could be a note in the logrotate man page,
(or anywhere else that fits) for warning the 
user about using size based logrotation AND
using the 
    /etc/init.d/syslog-ng reload >/dev/null
command in the "/var/log/syslog { " entry
of /etc/logrotate.d/syslog-ng.

(even if this is rarely the case...)

opinions ?

thanks

xavier