From owner-freebsd-security@FreeBSD.ORG  Mon May 26 14:12:13 2014
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id 216DFB58
 for <freebsd-security@freebsd.org>; Mon, 26 May 2014 14:12:13 +0000 (UTC)
Received: from smtp.des.no (smtp.des.no [194.63.250.102])
 by mx1.freebsd.org (Postfix) with ESMTP id D70AE2770
 for <freebsd-security@freebsd.org>; Mon, 26 May 2014 14:12:12 +0000 (UTC)
Received: from nine.des.no (smtp.des.no [194.63.250.102])
 by smtp-int.des.no (Postfix) with ESMTP id 85D10A6DE;
 Mon, 26 May 2014 14:12:11 +0000 (UTC)
Received: by nine.des.no (Postfix, from userid 1001)
 id 62DCC31126; Mon, 26 May 2014 16:11:52 +0200 (CEST)
From: =?utf-8?Q?Dag-Erling_Sm=C3=B8rgrav?= <des@des.no>
To: "Ronald F. Guilmette" <rfg@tristatelogic.com>
Subject: Re: NEVERMIND!
References: <2218.1401075427@server1.tristatelogic.com>
Date: Mon, 26 May 2014 16:11:52 +0200
In-Reply-To: <2218.1401075427@server1.tristatelogic.com> (Ronald
 F. Guilmette's message of "Sun, 25 May 2014 20:37:07 -0700")
Message-ID: <86r43gr5nb.fsf@nine.des.no>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.3 (berkeley-unix)
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Cc: freebsd-security@freebsd.org
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: "Security issues \[members-only posting\]"
 <freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-security>, 
 <mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security/>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
 <mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 26 May 2014 14:12:13 -0000

"Ronald F. Guilmette" <rfg@tristatelogic.com> writes:
> I forgot that newsyslog(8) should limit the size of /var/log/messages, and
> that as long as you limit the size of that to a reasnable value, and as
> long as you have newsyslog(8) only keeping a finite & reasonable number
> of "rotated out" copies, then /var won't fill up.

It can still happen, since newsyslog only runs once per hour.  If /var
fills up between two newsyslog runs, there is no guarantee that the
space freed up by deleting the oldest logs is sufficient to compress the
newest log.  The only way to really handle this issue would be to fold
newsyslog into syslog.

DES
--=20
Dag-Erling Sm=C3=B8rgrav - des@des.no