Re: logrotate strange argus behavior

On October 26, 2018 7:17:37 AM EDT, Monah Baki <monahbaki@gmail=2Ecom> wrot=
e:
>Hi Eric,
>
>So I removed the create 0600 waited for the logrotate to run and had
>the
>same issue=2E Then I specified in my command line " /usr/local/sbin/argus
>-m
>-U 2048 -i eth3 -w /var/log/argus/argus=2Eout -P 562" and waited for
>logrotate to run, same issue=2E
>Radium however is still running=2E
>
>cat /etc/issue=2Enet
>Red Hat Enterprise Linux Server release 6=2E10 (Santiago)
>
>Thanks
>Monah
>
>
>On Wed, Oct 24, 2018 at 11:55 AM Eric Kinzie <eric@qosient=2Ecom> wrote:
>
>> On Wed Oct 24 10:58:46 -0400 2018, Monah Baki wrote:
>> > Hi Carter,
>> >
>> > My argus=2Econf has:
>> > ARGUS_OUTPUT_FILE=3D/var/log/argus/argus=2Eout
>> >
>> > I can also for testing purposes run the -w option from the command
>line,
>> > what do you think?
>> >
>>
>> > > > /var/log/argus/argus=2Eout {
>> > > >     missingok
>> > > >     notifempty
>> > > >     compress
>> > > >     size 100M
>> > > >     daily
>> > > >     create 0600 root root
>> > > > }
>>
>> Monah, I think that if you remove the "create 0600=2E=2E=2E" line from
>> the logrotate configuration, argus=2Eout will be recreated by argus
>> and new records written to it=2E
>>
>> When logrotate creates a replacement file, the logic in argus that
>> checks to see if the file has been removed is effectively bypassed=2E
>> The original file it opened is no longer visible with "ls" because
>> gzip blows it away, but the file does actually still exist until
>> all file descriptors that reference it have been closed; argus
>> continues writing to it=2E
>>

I would suggest restarting Argus if you didn't already, to ensure that it =
doesn't still have an old file descriptor open=2E  It might also be a good =
idea to temporarily set the rotate interval to something short to see if th=
e change helps=2E  In any event, I'll take a look at this again today=2E