From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.io/gmane.comp.sysutils.supervision.general/570 Path: main.gmane.org!not-for-mail From: Gerrit Pape Newsgroups: gmane.comp.sysutils.supervision.general Subject: Re: [runit/svlogd] RFE: periodic log-rotation; filter-malfunction Date: Thu, 2 Sep 2004 19:48:11 +0000 Message-ID: <20040902194813.8878.qmail@892d5ec05c70b4.315fe32.mid.smarden.org> References: <87sma1dmfu.fsf@kosh.ultra.csn.tu-chemnitz.de> NNTP-Posting-Host: deer.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Trace: sea.gmane.org 1094154484 7019 80.91.224.253 (2 Sep 2004 19:48:04 GMT) X-Complaints-To: usenet@sea.gmane.org NNTP-Posting-Date: Thu, 2 Sep 2004 19:48:04 +0000 (UTC) Original-X-From: supervision-return-808-gcsg-supervision=m.gmane.org@list.skarnet.org Thu Sep 02 21:47:53 2004 Return-path: Original-Received: from antah.skarnet.org ([212.85.147.14]) by deer.gmane.org with smtp (Exim 3.35 #1 (Debian)) id 1C2xYm-0007xh-00 for ; Thu, 02 Sep 2004 21:47:52 +0200 Original-Received: (qmail 20529 invoked by uid 76); 2 Sep 2004 19:48:13 -0000 Mailing-List: contact supervision-help@list.skarnet.org; run by ezmlm List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Archive: Original-Received: (qmail 20524 invoked from network); 2 Sep 2004 19:48:13 -0000 Original-To: supervision@list.skarnet.org Mail-Followup-To: supervision@list.skarnet.org Content-Disposition: inline In-Reply-To: <87sma1dmfu.fsf@kosh.ultra.csn.tu-chemnitz.de> Xref: main.gmane.org gmane.comp.sysutils.supervision.general:570 X-Report-Spam: http://spam.gmane.org/gmane.comp.sysutils.supervision.general:570 On Thu, Sep 02, 2004 at 11:55:49AM +0200, Enrico Scholz wrote: > I am using svlogd 1.0.2 + socklog 1.5.0 which are great programs. But I > miss a small feature: I am using network logging and have some hosts > with a small log-volume. On these, the logrotation (configured with > 's4096') happens very seldom (perhaps 3-4 times per day) and I would > miss important messages when evaluating the logs on the loghost. > > Because the transfer is expensive (piped into stunnel), and I want to > share the configuration with other hosts with a higher log-volume, I do > not want to play with the 's....' parameter. > > Would it be possible to add another option (e.g. 'a') which > sends SIGALRM at seconds after the last logrotation? I'll have to think about it, in the meantime you could setup a separate service doing this work, e.g.: /var/service/socklogrotate/run: #!/bin/sh runsvctrl alarm /var/service/socklog exec sleep > Another issue: the '-/+...' filters seem to fail sometimes. E.g. I have > > in main/config > | -*: @* mail.*: * > > and in mail/config > | -* > | +*: @* mail.*: * > > These rules are working the most time, but I see single message like > > | @400000004136debc1e6b394c mailbox: @400000004136db9604ff84a4 mail.notice: Sep 2 10:36:28 imap[9964]: login: ... > > in main/current. This message is missing in mail/current, but other ones > transfered in the same logrotation at 'mailbox' are in mail/current as > expected. This shouldn't happen. Can you please give an exact example of a line that ends up in the wrong log, copied and pasted, and also re-check that you post the exact contents of the config files? Do you use the -r or -R command line options to svlogd in socklog-ucspi-tcp/log/run? Thanks, Gerrit.