Re: logrotate strange argus behavior

--0000000000007e863a0579242c6b
Content-Type: text/plain; charset="UTF-8"

Thanks Eric, works perfectly.

On Fri, Oct 26, 2018 at 10:19 AM Eric Kinzie <[email protected]> wrote:

> On Wed Oct 24 11:55:24 -0400 2018, Eric Kinzie wrote:
> > On Wed Oct 24 10:58:46 -0400 2018, Monah Baki wrote:
> > > Hi Carter,
> > >
> > > My argus.conf has:
> > > ARGUS_OUTPUT_FILE=/var/log/argus/argus.out
> > >
> > > I can also for testing purposes run the -w option from the command
> line,
> > > what do you think?
> > >
> >
> > > > > /var/log/argus/argus.out {
> > > > >     missingok
> > > > >     notifempty
> > > > >     compress
> > > > >     size 100M
> > > > >     daily
> > > > >     create 0600 root root
> > > > > }
> >
> > Monah, I think that if you remove the "create 0600..." line from
> > the logrotate configuration, argus.out will be recreated by argus
> > and new records written to it.
> >
> > When logrotate creates a replacement file, the logic in argus that
> > checks to see if the file has been removed is effectively bypassed.
> > The original file it opened is no longer visible with "ls" because
> > gzip blows it away, but the file does actually still exist until
> > all file descriptors that reference it have been closed; argus
> > continues writing to it.
>
>
> Removing the "create" line was not enough.  I added "nocreate" and
> argus created its own replacement file and started writing records
> to it.  See if that helps.
>

--0000000000007e863a0579242c6b
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Thanks Eric, works perfectly.</div><br><div class=3D"gmail=
_quote"><div dir=3D"ltr">On Fri, Oct 26, 2018 at 10:19 AM Eric Kinzie &lt;<=
a href=3D"mailto:[email protected]">[email protected]</a>&gt; wrote:<br></div=
><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1=
px #ccc solid;padding-left:1ex">On Wed Oct 24 11:55:24 -0400 2018, Eric Kin=
zie wrote:<br>
&gt; On Wed Oct 24 10:58:46 -0400 2018, Monah Baki wrote:<br>
&gt; &gt; Hi Carter,<br>
&gt; &gt; <br>
&gt; &gt; My argus.conf has:<br>
&gt; &gt; ARGUS_OUTPUT_FILE=3D/var/log/argus/argus.out<br>
&gt; &gt; <br>
&gt; &gt; I can also for testing purposes run the -w option from the comman=
d line,<br>
&gt; &gt; what do you think?<br>
&gt; &gt; <br>
&gt; <br>
&gt; &gt; &gt; &gt; /var/log/argus/argus.out {<br>
&gt; &gt; &gt; &gt;=C2=A0 =C2=A0 =C2=A0missingok<br>
&gt; &gt; &gt; &gt;=C2=A0 =C2=A0 =C2=A0notifempty<br>
&gt; &gt; &gt; &gt;=C2=A0 =C2=A0 =C2=A0compress<br>
&gt; &gt; &gt; &gt;=C2=A0 =C2=A0 =C2=A0size 100M<br>
&gt; &gt; &gt; &gt;=C2=A0 =C2=A0 =C2=A0daily<br>
&gt; &gt; &gt; &gt;=C2=A0 =C2=A0 =C2=A0create 0600 root root<br>
&gt; &gt; &gt; &gt; }<br>
&gt; <br>
&gt; Monah, I think that if you remove the &quot;create 0600...&quot; line =
from<br>
&gt; the logrotate configuration, argus.out will be recreated by argus<br>
&gt; and new records written to it.<br>
&gt; <br>
&gt; When logrotate creates a replacement file, the logic in argus that<br>
&gt; checks to see if the file has been removed is effectively bypassed.<br=
>
&gt; The original file it opened is no longer visible with &quot;ls&quot; b=
ecause<br>
&gt; gzip blows it away, but the file does actually still exist until<br>
&gt; all file descriptors that reference it have been closed; argus<br>
&gt; continues writing to it.<br>
<br>
<br>
Removing the &quot;create&quot; line was not enough.=C2=A0 I added &quot;no=
create&quot; and<br>
argus created its own replacement file and started writing records<br>
to it.=C2=A0 See if that helps.<br>
</blockquote></div>

--0000000000007e863a0579242c6b--