Re: Problem with Logfile Rotation / Inconsistency

Yoann Vandoorselaere schrieb:
> Le jeudi 21 février 2008 à 16:17 +0100, [email protected] a écrit :
>   
>>> However, if this happen at each rotation, without you restarting LML,
>>> then it look like a failure to properly detect the rotation. 
>>>
>>> If this is the case, please provide information about the way your logs
>>> are rotated (and the software doing it), and tell us whether LML is
>>> using the FAM backend.
>>>       
>> ok, that's new .... every time logs are rotated (every 6 hours) i
>> didn't restart lml ... now i'm trying that variant.
>> hope this will solve the problem ;) 
>>     
>
> I was not suggesting to restart LML upon log rotation, I was asking
> whether you did that. You shouldn't have to restart LML.
>
>   
>> thanks for your help.
>> would be great if there might be another way to solve this problem by
>> NOT restarting lml ever 6 hours, when i rotate logs.
>>
>> btw. i think i use FAM.
>> since i followed your tutorial when installing prelude a while ago i'm
>> pretty sure i compiled prelude-lml with fam support.
>>     
>
> Could you please try to deactivate FAM support and tell me whether the
> problem reproduce?
>
>   
ok, so now i deactivated the FAM support but the problem keeps 
reproducing regularly.

but i discovered that when i restart lml every time logs are rotated no 
"logfile inconsistency" is sent out by the sensor.

thanks,
david
_______________________________________________
Prelude-user site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-user