Re: Strange log-rotate problem

[Andrew Reid <reidac@bellatlantic.net>]

On Saturday 22 August 2009 02:09:09 Sven Joachim wrote:
> On 2009-08-22 01:08 +0200, Andrew Reid wrote:

> >   My problem is that I can't figure out who is rotating
> > /var/log/auth.log.
> >
> >   It's currently being rotated every day, and retained for a week.
> >
> If you are using sysklogd (the standard syslog daemon in Etch), the
> answer is that it uses savelog, not logrotate.  See bug #44523¹.
>
> The good news is that in Lenny and later, rsyslog² is the standard
> syslog daemon, and it uses logrotate.  Of course, upgrading an existing
> system will not change your syslog daemon.

  Thanks, this is helpful.

  I found the sysklogd cron entries, but I further thought the 
daily one (in /etc/cron.daily/sysklogd) wasn't rotating auth.log --
it uses "syslogd-listfiles" to get the set of files to rotate daily,
and when I ran it interactively, it returned an empty string.

  However, as a sanity check, I instrumented /etc/cron.daily/sysklogd,
and sure enough, it *is* doing the mystery rotation.

  So, now I can adjust it to comply with policy, which solves
the immediate problem.

  The remaining mystery is, why does the "syslogd-listfiles" give
different answers interactively versus inside a cron script?  Probably
some environment thing.

>
> There is also an Etch backport of rsyslog, if you would like to use it
> without upgrading to Lenny.

  I'll probably be upgrading to Lenny in a few weeks anyways, so I'll just
wait, I think.  However, I did want to mention that I am a big fan of 
backports, they've helped me out a lot over the years.

				-- A.

-- 
Andrew Reid / reidac@bellatlantic.net