Re: logrotate strange argus behavior

--00000000000099241f05791fde1a
Content-Type: text/plain; charset="UTF-8"

Hi Eric,

So I removed the create 0600 waited for the logrotate to run and had the
same issue. Then I specified in my command line " /usr/local/sbin/argus -m
-U 2048 -i eth3 -w /var/log/argus/argus.out -P 562" and waited for
logrotate to run, same issue.
Radium however is still running.

cat /etc/issue.net
Red Hat Enterprise Linux Server release 6.10 (Santiago)

Thanks
Monah


On Wed, Oct 24, 2018 at 11:55 AM Eric Kinzie <[email protected]> wrote:

> On Wed Oct 24 10:58:46 -0400 2018, Monah Baki wrote:
> > Hi Carter,
> >
> > My argus.conf has:
> > ARGUS_OUTPUT_FILE=/var/log/argus/argus.out
> >
> > I can also for testing purposes run the -w option from the command line,
> > what do you think?
> >
>
> > > > /var/log/argus/argus.out {
> > > >     missingok
> > > >     notifempty
> > > >     compress
> > > >     size 100M
> > > >     daily
> > > >     create 0600 root root
> > > > }
>
> Monah, I think that if you remove the "create 0600..." line from
> the logrotate configuration, argus.out will be recreated by argus
> and new records written to it.
>
> When logrotate creates a replacement file, the logic in argus that
> checks to see if the file has been removed is effectively bypassed.
> The original file it opened is no longer visible with "ls" because
> gzip blows it away, but the file does actually still exist until
> all file descriptors that reference it have been closed; argus
> continues writing to it.
>

--00000000000099241f05791fde1a
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr">Hi Eric,<div><br></div><=
div>So I removed the create 0600 waited for the logrotate to run and had th=
e same issue. Then I specified in my command line &quot; /usr/local/sbin/ar=
gus -m -U 2048 -i eth3 -w /var/log/argus/argus.out -P 562&quot; and waited =
for logrotate to run, same issue.</div><div>Radium however is still running=
.</div><div><br></div><div><div>cat /etc/<a href=3D"http://issue.net">issue=
.net</a></div><div>Red Hat Enterprise Linux Server release 6.10 (Santiago)<=
/div></div><div><br></div><div>Thanks</div><div>Monah</div><div><br></div><=
/div></div></div><br><div class=3D"gmail_quote"><div dir=3D"ltr">On Wed, Oc=
t 24, 2018 at 11:55 AM Eric Kinzie &lt;<a href=3D"mailto:[email protected]">=
[email protected]</a>&gt; wrote:<br></div><blockquote class=3D"gmail_quote" =
style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On =
Wed Oct 24 10:58:46 -0400 2018, Monah Baki wrote:<br>
&gt; Hi Carter,<br>
&gt; <br>
&gt; My argus.conf has:<br>
&gt; ARGUS_OUTPUT_FILE=3D/var/log/argus/argus.out<br>
&gt; <br>
&gt; I can also for testing purposes run the -w option from the command lin=
e,<br>
&gt; what do you think?<br>
&gt; <br>
<br>
&gt; &gt; &gt; /var/log/argus/argus.out {<br>
&gt; &gt; &gt;=C2=A0 =C2=A0 =C2=A0missingok<br>
&gt; &gt; &gt;=C2=A0 =C2=A0 =C2=A0notifempty<br>
&gt; &gt; &gt;=C2=A0 =C2=A0 =C2=A0compress<br>
&gt; &gt; &gt;=C2=A0 =C2=A0 =C2=A0size 100M<br>
&gt; &gt; &gt;=C2=A0 =C2=A0 =C2=A0daily<br>
&gt; &gt; &gt;=C2=A0 =C2=A0 =C2=A0create 0600 root root<br>
&gt; &gt; &gt; }<br>
<br>
Monah, I think that if you remove the &quot;create 0600...&quot; line from<=
br>
the logrotate configuration, argus.out will be recreated by argus<br>
and new records written to it.<br>
<br>
When logrotate creates a replacement file, the logic in argus that<br>
checks to see if the file has been removed is effectively bypassed.<br>
The original file it opened is no longer visible with &quot;ls&quot; becaus=
e<br>
gzip blows it away, but the file does actually still exist until<br>
all file descriptors that reference it have been closed; argus<br>
continues writing to it.<br>
</blockquote></div>

--00000000000099241f05791fde1a--