[PLUG] (no subject)

[Rich Shepard]

On Thu, 3 Oct 2002, Russ Johnson wrote:

> It says it's truncating... Were you running as root so that it would 
> have permission to do so?

Russ,

  Yes, I was.
 
> See what happens when you simplify this. The syslog logrotate 
> configuration file only has
> 
> /var/log/messages /var/log/secure /var/log/maillog /var/log/spooler 
> /var/log/boot.log /var/log/cron {
>     sharedscripts
>     postrotate
>     /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null 
> || true
>     endscript
> }

  I was getting error messages about two attempts to rotate /var/log/maillog
so I took out the reference in /etc/logrotate.d/syslog.
 
> in it. Put this in your maillog stanza:
> 
> /var/log/maillog {
>     daily
>     sharedscripts
>     postrotate
>     /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null 
> || true
>     endscript
> }
> 
> I believe it should inherit the rotate 4 from /etc/logrotate.conf, and 
> I'm not sure the rest is needed.

  I'm not sure either. I _think_ I got this from the postfix installation,
but I'm not sure who put it there.

  Well, I just made your recommended changes and re-ran logrotate with debug
on. According to the output:

rotating pattern: /var/log/maillog  after 1 days (4 rotations)
empty log files are rotated, old logs are removed
considering log /var/log/maillog
  log needs rotating
rotating log /var/log/maillog
renaming /var/log/maillog.5 to /var/log/maillog.5 (rotatecount 4, logstart
1, i 5), 
renaming /var/log/maillog.4 to /var/log/maillog.5 (rotatecount 4, logstart
1, i 4), 
renaming /var/log/maillog.3 to /var/log/maillog.4 (rotatecount 4, logstart
1, i 3), 
renaming /var/log/maillog.2 to /var/log/maillog.3 (rotatecount 4, logstart
1, i 2), 
renaming /var/log/maillog.1 to /var/log/maillog.2 (rotatecount 4, logstart
1, i 1), 
renaming /var/log/maillog.0 to /var/log/maillog.1 (rotatecount 4, logstart
1, i 0), 
renaming /var/log/maillog to /var/log/maillog.1
creating new log mode = 0600 uid = 0 gid = 0
removing old log /var/log/maillog.5
running shared postrotate script
running script with arg /var/log/maillog : "   
    /bin/kill -HUP at /var/run/syslogd.pid 2> /dev/null 2> /dev/null
  || true
"
  Looks great, eh? But, ls -la /var/log shows:

-rw-------    1 root     root      1046804 Oct  3 13:38 maillog
-rw-------    1 root     root       938543 Sep  8 01:02 maillog.2

  No maillog.1, no new maillog, existing maillog still has records from 30
September.

  The logrotate debug output reports all these changes, but they are not
seen in /var/log. Is this user error some place? I'm really puzzled now.

Thanks,

Rich