Re: [gentoo-user] strange cron messages...

[Alan McKinnon]

On Monday 16 November 2009 17:55:51 Eray Aslan wrote:
> On 16.11.2009 14:46, Neil Bothwick wrote:
> > On Mon, 16 Nov 2009 09:05:18 +0200, Eray Aslan wrote:
> >>     - No need to logrotate with time based filenames.  Hence, no need to
> >> "kill -HUP" the syslog daemon.  No missed logs.
> >
> > Then how do you get the server to use the new logfile names each
> > day/week?
>
> It creates and uses a new file each hour/day/etc.  Perhaps, you missed
> the file(...) directive?  Reposting for your reference:
>
>     destination mail {
> 	    file("/var/log/mail/$YEAR/$MONTH/$DAY/$HOUR"
> 	    [...]
>
> > You only need to send a SIGHUP to the server using that log
> > facility, so syslog would not be affected in your example.
>
> I can't parse this.  The point is avoiding SIGHUP so that we do not miss
> any log messages.
>
> OP asked how one manages log files without logrotate and the answer is
> with time based file names.  It has the additional benefit of avoiding
> SIGHUP.
>

I have three machines that randomly kill syslog or syslog-ng as appropriate 
whenever they feel like it on daily rotates. There's no warning, no evidence, 
they just ... die. 5 minutes later nagios goes ballistic and I have work to 
do. That all three are SuSE machines is probably highly relevant.

So, anything that syslog-ng can do itself without needing external 
intervention is a very good thing. I can then compress and move the closed 
files around later at my leisure in complete safety.

-- 
alan dot mckinnon at gmail dot com