> > ok, since nobody seems to be able to help me with my quite severe problem maybe a few more hints:
> >
> > /var/log/messages shows the following lines after each rotation:
> >
> > Jan 31 06:00:01 ids-master prelude-lml: WARNING: /var/log/auth.log: Metadata available, but checksum is invalid, starting at 0.
> > Jan 31 06:00:01 ids-master prelude-lml: WARNING: /var/log/messages: Metadata available, but checksum is invalid, starting at 0.
>
> This is not an error, in recent Prelude-LML version, the message has
> been renamed to: "log file was rotated, starting from head.".
yeah, saw it when looking through the code. sad thing though ... freebsd ports aren't that up-to-date. still using lml 0.9.10.1.
> However, if this happen at each rotation, without you restarting LML,
> then it look like a failure to properly detect the rotation.
>
> If this is the case, please provide information about the way your logs
> are rotated (and the software doing it), and tell us whether LML is
> using the FAM backend.
ok, that's new .... every time logs are rotated (every 6 hours) i didn't restart lml ... now i'm trying that variant.
hope this will solve the problem ;)
thanks for your help.
would be great if there might be another way to solve this problem by NOT restarting lml ever 6 hours, when i rotate logs.
btw. i think i use FAM.
since i followed your tutorial when installing prelude a while ago i'm pretty sure i compiled prelude-lml with fam support.
mfg
david
_______________________________________________________________________
Jetzt neu! Schützen Sie Ihren PC mit McAfee und WEB.DE. 30 Tage
kostenlos testen. http://www.pc-sicherheit.web.de/startseite/?mc=022220
_______________________________________________
Prelude-user site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-user
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.