From owner-freebsd-stable@FreeBSD.ORG Wed Sep 7 11:27:28 2011 Return-Path: Delivered-To: stable@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id E20CF106564A for ; Wed, 7 Sep 2011 11:27:27 +0000 (UTC) (envelope-from egrosbein@rdtc.ru) Received: from eg.sd.rdtc.ru (unknown [IPv6:2a03:3100:c:13::5]) by mx1.freebsd.org (Postfix) with ESMTP id 47E758FC08 for ; Wed, 7 Sep 2011 11:27:27 +0000 (UTC) Received: from eg.sd.rdtc.ru (localhost [127.0.0.1]) by eg.sd.rdtc.ru (8.14.5/8.14.5) with ESMTP id p87BRN6M019315; Wed, 7 Sep 2011 18:27:23 +0700 (NOVST) (envelope-from egrosbein@rdtc.ru) Message-ID: <4E675516.50304@rdtc.ru> Date: Wed, 07 Sep 2011 18:27:18 +0700 From: Eugene Grosbein User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; ru-RU; rv:1.9.2.13) Gecko/20110112 Thunderbird/3.1.7 MIME-Version: 1.0 To: Jeremy Chadwick References: <4E35881C.2010505@rdtc.ru> <20110731173129.GA53635@icarus.home.lan> <4E672F2E.7090400@rdtc.ru> <20110907100827.GA96216@icarus.home.lan> In-Reply-To: <20110907100827.GA96216@icarus.home.lan> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Cc: stable@freebsd.org Subject: Re: running newsyslog fiveminly X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Sep 2011 11:27:28 -0000 07.09.2011 17:08, Jeremy Chadwick writes: >> After reading newsyslog code, now it's obvious it just ignores minutes and seconds >> while making decision if a file should be rotated. It looks at hours only. >> That's sad. > > I imagine this "design limitation" is due to the fact that newsyslog is > called from cron, which only supports minute-level granularity. > > The newsyslog.conf man page even hints at this while describing the > "when" column: > > There is no provision for the specification of a timezone. There > is little point in specifying an explicit minutes or seconds com- > ponent in the current implementation, since the only comparison > is ``within the hour''. > > Given this, I would say the "special" 3600-second value within the > source code makes sense. > > I'm not sure what you could use for an alternate method of log rotation > for syslog-logged data. I have just followed some of past advices and split my newsyslog.conf in two, moving mpd-like logs with size-based rotation only to /etc/newsyslog-quick.conf. And made another cron job for fiveminly running newsyslog -f /etc/newsyslog-quick.conf > I think what the rest of the world might tell you is something to the > effect of "you can't have your cake and eat it too". You've got > diskless systems that aren't syslogging via network (e.g. to a pool of > syslog servers, or a single syslog server) but instead to a > memory-backed filesystem, in addition to enabling debug-level logging in > mpd by default. > > A memory-backed filesystem means you don't have much disk space, and you > know this based on the need to rotate logs every 5 minutes, right? So > I'm confused why one would need debug logging. I imagine that the > newsyslog.conf on these machines has a very small number for the "count" > column for /var/log/mpd.log. So chances are, by the time you noticed a > problem, the logs would have been rotated and removed, no? So why the > debug logging? > > If debug logging really is something you absolutely need, no argument > about it, then honestly it sounds like you need some sort of > "centralised" logging infrastructure for all of these diskless machines. > Most diskless machines I've used utilise some form of centralised > "something" -- whether it be a centralised DHCP/PXE server (which you > obviously have in some form), or an NFS-mounted root or /home, etc... > You get the idea. Could you deploy similar infrastructure for syslog > and simply use a remote syslog server in syslog.conf? In fact, I do have centralized syslogd server that collects logs from diskless servers. But, I need also local copies of individual server's logs in the MFS. I was in hope to make it with one cron job and one newsyslog.conf but as it seems impossible, I will use two cron jobs :-) Local (compressed) logs residing on the MFS give me convinience to manage and debug a server within one ssh session without need to consult with remote syslog archives. In general, I do have enough MFS space to keep needed backlog but in case of network PPPoE PADI broadcast storms I need quick rotation to prevent MFS overflows. I think I'll get all of this now. Eugene Grosbein