From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.io/gmane.comp.sysutils.supervision.general/569 Path: main.gmane.org!not-for-mail From: Enrico Scholz Newsgroups: gmane.comp.sysutils.supervision.general Subject: [runit/svlogd] RFE: periodic log-rotation; filter-malfunction Date: Thu, 02 Sep 2004 11:55:49 +0200 Message-ID: <87sma1dmfu.fsf@kosh.ultra.csn.tu-chemnitz.de> NNTP-Posting-Host: deer.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Trace: sea.gmane.org 1094118970 3916 80.91.224.253 (2 Sep 2004 09:56:10 GMT) X-Complaints-To: usenet@sea.gmane.org NNTP-Posting-Date: Thu, 2 Sep 2004 09:56:10 +0000 (UTC) Original-X-From: supervision-return-807-gcsg-supervision=m.gmane.org@list.skarnet.org Thu Sep 02 11:56:01 2004 Return-path: Original-Received: from antah.skarnet.org ([212.85.147.14]) by deer.gmane.org with smtp (Exim 3.35 #1 (Debian)) id 1C2oK1-00026G-00 for ; Thu, 02 Sep 2004 11:56:01 +0200 Original-Received: (qmail 16851 invoked by uid 76); 2 Sep 2004 09:56:17 -0000 Mailing-List: contact supervision-help@list.skarnet.org; run by ezmlm List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Archive: Original-Received: (qmail 16845 invoked from network); 2 Sep 2004 09:56:16 -0000 Original-To: supervision@list.skarnet.org User-Agent: Gnus/5.1006 (Gnus v5.10.6) XEmacs/21.4 (Security Through Obscurity, linux) X-Scanned-By: MIMEDefang 2.43 X-Scan-Signature: 1799bf12b35d447918a318cb0019563e Xref: main.gmane.org gmane.comp.sysutils.supervision.general:569 X-Report-Spam: http://spam.gmane.org/gmane.comp.sysutils.supervision.general:569 Hello, I am using svlogd 1.0.2 + socklog 1.5.0 which are great programs. But I miss a small feature: I am using network logging and have some hosts with a small log-volume. On these, the logrotation (configured with 's4096') happens very seldom (perhaps 3-4 times per day) and I would miss important messages when evaluating the logs on the loghost. Because the transfer is expensive (piped into stunnel), and I want to share the configuration with other hosts with a higher log-volume, I do not want to play with the 's....' parameter. Would it be possible to add another option (e.g. 'a') which sends SIGALRM at seconds after the last logrotation? Another issue: the '-/+...' filters seem to fail sometimes. E.g. I have in main/config | -*: @* mail.*: * and in mail/config | -* | +*: @* mail.*: * These rules are working the most time, but I see single message like | @400000004136debc1e6b394c mailbox: @400000004136db9604ff84a4 mail.notice: Sep 2 10:36:28 imap[9964]: login: ... in main/current. This message is missing in mail/current, but other ones transfered in the same logrotation at 'mailbox' are in mail/current as expected. I guess this has something to do with wrapping buffers (mailbox has the 's4096' setting), but I can not give a reproducible example. Enrico