From owner-freebsd-stable@FreeBSD.ORG Wed Sep 7 08:45:44 2011 Return-Path: Delivered-To: stable@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id BA199106566B for ; Wed, 7 Sep 2011 08:45:44 +0000 (UTC) (envelope-from egrosbein@rdtc.ru) Received: from eg.sd.rdtc.ru (unknown [IPv6:2a03:3100:c:13::5]) by mx1.freebsd.org (Postfix) with ESMTP id 213F78FC14 for ; Wed, 7 Sep 2011 08:45:43 +0000 (UTC) Received: from eg.sd.rdtc.ru (localhost [127.0.0.1]) by eg.sd.rdtc.ru (8.14.5/8.14.5) with ESMTP id p878jdXF018132; Wed, 7 Sep 2011 15:45:40 +0700 (NOVST) (envelope-from egrosbein@rdtc.ru) Message-ID: <4E672F2E.7090400@rdtc.ru> Date: Wed, 07 Sep 2011 15:45:34 +0700 From: Eugene Grosbein User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; ru-RU; rv:1.9.2.13) Gecko/20110112 Thunderbird/3.1.7 MIME-Version: 1.0 To: Jeremy Chadwick References: <4E35881C.2010505@rdtc.ru> <20110731173129.GA53635@icarus.home.lan> In-Reply-To: <20110731173129.GA53635@icarus.home.lan> Content-Type: text/plain; charset=KOI8-R Content-Transfer-Encoding: 8bit Cc: stable@freebsd.org Subject: Re: running newsyslog fiveminly X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Sep 2011 08:45:44 -0000 01.08.2011 00:31, Jeremy Chadwick пишет: > On Sun, Jul 31, 2011 at 11:51:40PM +0700, Eugene Grosbein wrote: >> Hi! >> >> Suppose, there is a machine which writes two kinds of log files through syslogd: >> quickly-growing that need to be rotated based on their size (hourly is too seldom) >> and other that should be rotated once a day, at midnight only. >> >> For first kind of logs we have to run newsyslog once every 5 minutes using cron: >> >> */5 * * * * root newsyslog >> >> For second kind of logs we have lines in newsyslog.conf such as following: >> >> /var/log/mpd.log 640 16 * @T0000 JC >> >> This must ensure that /var/log/mpd.log is rotated and compressed at midnigt only. >> Note, that compressing the file takes 8 minutes. >> >> However, every night at 00:05 I get an error: >> >> bzip2: I/O or other error, bailing out. Possible reason follows. >> bzip2: No such file or directory >> Input file = /var/log/mpd.log.0, output file = /var/log/mpd.log.0.bz2 >> newsyslog: `bzip2 -f /var/log/mpd.log.0' terminated with a non-zero status (1) >> >> It seems, newsyslog still wants to process my file at 00:05 despite @T0000 >> time specification. Is it broken? > > I have three things to say on the matter, all of which are somewhat > independent of one another so please keep that in mind. I imagine #1 > below is your problem. > > 1) The newsyslog.conf(5) man page has this clause in it, for the "when" > field (in your case, @T0000): > > when ... If the when field contains an asterisk (`*'), log rotation > will solely depend on the contents of the size field. Otherwise, > the when field consists of an optional interval in hours, usually > followed by an `@'-sign and a time in restricted ISO 8601 format. > > If a time is specified, the log file will only be trimmed if > newsyslog(8) is run within one hour of the specified time. If an > interval is specified, the log file will be trimmed if that many > hours have passed since the last rotation. ... > > You might think that "one hour of the specified time" value/clause > correlates with the interval that newsyslog is run at via cron, but that > would be wrong. newsyslog REALLY DOES have hard-coded values for 3600 > seconds (1 hour) in it (grep -r 3600 /usr/src/usr.sbin/newsyslog). I > have not looked at the code, but the fact of the matter is, 1 hour > appears to be a "special" value. I would heed that as a warning. After reading newsyslog code, now it's obvious it just ignores minutes and seconds while making decision if a file should be rotated. It looks at hours only. That's sad. Eugene Grosbein