Date: Wed, 07 Sep 2011 15:45:34 +0700 From: Eugene Grosbein <egrosbein@rdtc.ru> To: Jeremy Chadwick <freebsd@jdc.parodius.com> Cc: stable@freebsd.org Subject: Re: running newsyslog fiveminly Message-ID: <4E672F2E.7090400@rdtc.ru> In-Reply-To: <20110731173129.GA53635@icarus.home.lan> References: <4E35881C.2010505@rdtc.ru> <20110731173129.GA53635@icarus.home.lan>
next in thread | previous in thread | raw e-mail | index | archive | help
01.08.2011 00:31, Jeremy Chadwick пишет: > On Sun, Jul 31, 2011 at 11:51:40PM +0700, Eugene Grosbein wrote: >> Hi! >> >> Suppose, there is a machine which writes two kinds of log files through syslogd: >> quickly-growing that need to be rotated based on their size (hourly is too seldom) >> and other that should be rotated once a day, at midnight only. >> >> For first kind of logs we have to run newsyslog once every 5 minutes using cron: >> >> */5 * * * * root newsyslog >> >> For second kind of logs we have lines in newsyslog.conf such as following: >> >> /var/log/mpd.log 640 16 * @T0000 JC >> >> This must ensure that /var/log/mpd.log is rotated and compressed at midnigt only. >> Note, that compressing the file takes 8 minutes. >> >> However, every night at 00:05 I get an error: >> >> bzip2: I/O or other error, bailing out. Possible reason follows. >> bzip2: No such file or directory >> Input file = /var/log/mpd.log.0, output file = /var/log/mpd.log.0.bz2 >> newsyslog: `bzip2 -f /var/log/mpd.log.0' terminated with a non-zero status (1) >> >> It seems, newsyslog still wants to process my file at 00:05 despite @T0000 >> time specification. Is it broken? > > I have three things to say on the matter, all of which are somewhat > independent of one another so please keep that in mind. I imagine #1 > below is your problem. > > 1) The newsyslog.conf(5) man page has this clause in it, for the "when" > field (in your case, @T0000): > > when ... If the when field contains an asterisk (`*'), log rotation > will solely depend on the contents of the size field. Otherwise, > the when field consists of an optional interval in hours, usually > followed by an `@'-sign and a time in restricted ISO 8601 format. > > If a time is specified, the log file will only be trimmed if > newsyslog(8) is run within one hour of the specified time. If an > interval is specified, the log file will be trimmed if that many > hours have passed since the last rotation. ... > > You might think that "one hour of the specified time" value/clause > correlates with the interval that newsyslog is run at via cron, but that > would be wrong. newsyslog REALLY DOES have hard-coded values for 3600 > seconds (1 hour) in it (grep -r 3600 /usr/src/usr.sbin/newsyslog). I > have not looked at the code, but the fact of the matter is, 1 hour > appears to be a "special" value. I would heed that as a warning. After reading newsyslog code, now it's obvious it just ignores minutes and seconds while making decision if a file should be rotated. It looks at hours only. That's sad. Eugene Grosbein
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4E672F2E.7090400>