Re: Problem with Logfile Rotation / Inconsistency
Yoann Vandoorselaere <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Message-ID | <1206442006.21275.28.camel@arwen> |
Hello David, Le vendredi 21 mars 2008 à 11:19 +0100, [email protected] a écrit : > BigDaddy schrieb: > > Yoann Vandoorselaere schrieb: > >> Le jeudi 21 février 2008 à 16:17 +0100, [email protected] a écrit : > >> > >>>> However, if this happen at each rotation, without you restarting LML, > >>>> then it look like a failure to properly detect the rotation. > >>>> > >>>> If this is the case, please provide information about the way your logs > >>>> are rotated (and the software doing it), and tell us whether LML is > >>>> using the FAM backend. > >>>> > >>> thanks for your help. > >>> would be great if there might be another way to solve this problem by > >>> NOT restarting lml ever 6 hours, when i rotate logs. > >>> > >>> btw. i think i use FAM. > >>> since i followed your tutorial when installing prelude a while ago i'm > >>> pretty sure i compiled prelude-lml with fam support. > >>> > >>> > >> Could you please try to deactivate FAM support and tell me whether the > >> problem reproduce? > >> > >> > >> > > ok, so now i deactivated the FAM support but the problem keeps > > reproducing regularly. > > > > but i discovered that when i restart lml every time logs are rotated no > > "logfile inconsistency" is sent out by the sensor. > > ok, it's seems like i ran prelude-lml all along without FAM support on > our freebsd servers - sorry for that mis-information. now i tested on > three servers recompiling prelude-lml NOW WITH FAM-SUPPORT .... but > still i receive : "logfile inconsistency" alerts every time logfiles are > rotatetd by the system. > > something interesting i noticed: these "logfile inconsisteny" alerts > produce only on servers with very little logfile activitiy, meaning > sometimes the /var/log/messages contains only the two messages that the > logfile is being rotated and nothing else and then a "logfile > inconsistency" alert is produced. > > maybe this is possible hint in order to support me solving this problem. Could you provide us with the detail of the "logfile inconsistency" generated alerts (use prelude-manager --debug, and send the relevant alerts to the list). It should contain information that will help tracing the problem. Regards, -- Yoann Vandoorselaere | Responsable R&D / CTO | PreludeIDS Technologies Tel: +33 (0)8 70 70 21 58 Fax: +33(0)4 78 42 21 58 http://www.prelude-ids.com _______________________________________________ Prelude-user site list [email protected] http://www.prelude-ids.org/mailman/listinfo/prelude-user