Re: [runit/svlogd] RFE: periodic log-rotation; filter-malfunction

[Gerrit Pape <pape@smarden.org>]

On Thu, Sep 02, 2004 at 11:55:49AM +0200, Enrico Scholz wrote:
> I am using svlogd 1.0.2 + socklog 1.5.0 which are great programs. But I
> miss a small feature: I am using network logging and have some hosts
> with a small log-volume. On these, the logrotation (configured with
> 's4096') happens very seldom (perhaps 3-4 times per day) and I would
> miss important messages when evaluating the logs on the loghost.
> 
> Because the transfer is expensive (piped into stunnel), and I want to
> share the configuration with other hosts with a higher log-volume, I do
> not want to play with the 's....' parameter.
> 
> Would it be possible to add another option (e.g. 'a<seconds>') which
> sends SIGALRM at <seconds> seconds after the last logrotation?

I'll have to think about it, in the meantime you could setup a separate
service doing this work, e.g.:

 /var/service/socklogrotate/run:
 #!/bin/sh
 runsvctrl alarm /var/service/socklog
 exec sleep <seconds>

> Another issue: the '-/+...' filters seem to fail sometimes. E.g. I have
> 
> in main/config
> | -*: @* mail.*: *
> 
> and in mail/config
> | -*
> | +*: @* mail.*: *
> 
> These rules are working the most time, but I see single message like
> 
> | @400000004136debc1e6b394c mailbox: @400000004136db9604ff84a4 mail.notice: Sep  2 10:36:28 imap[9964]: login: ...
> 
> in main/current. This message is missing in mail/current, but other ones
> transfered in the same logrotation at 'mailbox' are in mail/current as
> expected.

This shouldn't happen.  Can you please give an exact example of a line
that ends up in the wrong log, copied and pasted, and also re-check that
you post the exact contents of the config files?  Do you use the -r or
-R command line options to svlogd in socklog-ucspi-tcp/log/run?

Thanks, Gerrit.