From owner-freebsd-questions@FreeBSD.ORG Mon Mar 15 14:15:34 2004 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 9FEC716A4CE for ; Mon, 15 Mar 2004 14:15:34 -0800 (PST) Received: from theatre.msu.edu (theatre.msu.edu [35.8.69.30]) by mx1.FreeBSD.org (Postfix) with ESMTP id 3E90343D2F for ; Mon, 15 Mar 2004 14:15:34 -0800 (PST) (envelope-from sagejona@theatre.msu.edu) Received: from theatre.msu.edu (c-67-167-140-34.client.comcast.net [67.167.140.34]) (authenticated bits=0) by theatre.msu.edu (8.12.11/8.12.11) with ESMTP id i2FMFIMa054678 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Mon, 15 Mar 2004 17:15:18 -0500 (EST) (envelope-from sagejona@theatre.msu.edu) Message-ID: <40562AFC.4080004@theatre.msu.edu> Date: Mon, 15 Mar 2004 17:15:24 -0500 From: "Jonathan T. Sage" Organization: MSU Dept of Theatre User-Agent: Mozilla Thunderbird 0.5 (Windows/20040207) X-Accept-Language: en-us, en MIME-Version: 1.0 To: Bart Silverstrim , questions@freebsd.org References: <000c01c2eafb$52cfdbc0$0401a8c0@bloodlust> <4055EAFE.7050503@theatre.msu.edu> <8FDB539E-76AA-11D8-A92D-000A956D2452@chrononomicon.com> <4055EFAD.5080202@theatre.msu.edu> <588423B0-76AC-11D8-A92D-000A956D2452@chrononomicon.com> In-Reply-To: <588423B0-76AC-11D8-A92D-000A956D2452@chrononomicon.com> X-Enigmail-Version: 0.83.3.0 X-Enigmail-Supports: pgp-inline, pgp-mime X-Phone: +1-517-974-1428 X-WWW-Home-Page: http://theatre.msu.edu X-PGP-Key-Figerprint: 182C CF3F 93A9 1DAA 2EBE D4D5 A159 96D9 452E A7F1 X-IM: AIM(jonathantsage,spartyman), ICQ(9587621), YIM(wisesage98) Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="------------enig8F22D71729AE5D4798ADC524" X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.63 X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on www.theatre.msu.edu X-Virus-Scanned: clamd / ClamAV version devel-20040309, clamav-milter version 0.67j Subject: ClamAV Log Rotation (WAS: Antivirus suggestion...) X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 15 Mar 2004 22:15:34 -0000 This is an OpenPGP/MIME signed message (RFC 2440 and 3156) --------------enig8F22D71729AE5D4798ADC524 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Hope this is of some use: Bart Silverstrim wrote: >>>>> I haven't tried it on Exim, but I've had mostly good luck with >>>>> ClamAV (need to work on the log rotation question >>>>> I've posted previously about, though...) >>>> Speaking of that log question, have you been able to prove >>>> (substantiate may be a better word) that this happens? also note >>>> that newsyslog has the ability to -HUP a process when it rotates a >>>> log file (for details on how to do this, take a look at apache log >>>> rotation howtos). >>> I have been seeing several posts to the clamav-users list about it >>> happening, that once it hits the quota limit for the logfile size >>> that it will stop working. Has it happened to me yet? no...my >>> logfile hasn't reached the 5 meg limit yet :-) >>> I do need to find a way to rotate the log though. I'm just waiting >>> to find someone that can say "yes, I'm running clamav, and using >>> newsyslog to rotate the log, here's the line I use in the conf file >>> to do it and here's the line I use in the clamav.conf file to get it >>> to work..." > Hey, if you get a working rotation configuration for Clamd, please do > share! :-) I've got a production server holding it's own in proving > open source software is a viable alternative to the commercial fellas > for our school district, and I don't need to have our mail system go > belly up because of an overgrown logfile :-) Clamd log rotation: first and foremost, make sure that clamav is gonna drop a pidfile. in /usr/local/etc/clamav.conf, uncomment: # This option allows you to save the process identifier of the listening # daemon (main thread). PidFile /var/run/clamd.pid then, add the following (one line) to /etc/newsyslog.conf /var/log/clamd.log 644 3 * $W0D1 BJ \ /var/run/clamd.pid 1 this will rotate the log once a week, keep 3 of them (current log +3 weeks). it will also compress the old one with bzip2 and SIGHUP the clamd process. seems to work just fine for me, running clamav-devel on -current (Mar 3 or so right now) ~j -- Jonathan T. Sage Theatrical Lighting / Set Designer Professional Web Design [HTTP://www.JTSage.com] [sagejona@msu.edu] [See Headers for Contact Info] --------------enig8F22D71729AE5D4798ADC524 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (MingW32) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFAVisAoVmW2UUup/ERAnr5AJwN9vO7cvSyTB55OLQInz4Glm7WSwCdH9LN RAXVc3HsMTYmLmJ7u74uYcQ= =AmVC -----END PGP SIGNATURE----- --------------enig8F22D71729AE5D4798ADC524--