Date: Sun, 31 Jul 2011 22:39:48 -0400 From: Jason Hellenthal <jhell@DataIX.net> To: Eugene Grosbein <egrosbein@rdtc.ru> Cc: stable@freebsd.org, Jeremy Chadwick <freebsd@jdc.parodius.com> Subject: Re: running newsyslog fiveminly Message-ID: <20110801023948.GA77144@DataIX.net> In-Reply-To: <4E359753.3050004@rdtc.ru> References: <4E35881C.2010505@rdtc.ru> <20110731173129.GA53635@icarus.home.lan> <4E359753.3050004@rdtc.ru>
next in thread | previous in thread | raw e-mail | index | archive | help
[-- Attachment #1 --] What line of the newsyslog.conf file is your line inserted and can you move that to a higher line number. FIFO On Mon, Aug 01, 2011 at 12:56:35AM +0700, Eugene Grosbein wrote: > 01.08.2011 00:31, Jeremy Chadwick writes: > > >> For second kind of logs we have lines in newsyslog.conf such as following: > >> > >> /var/log/mpd.log 640 16 * @T0000 JC > >> > >> This must ensure that /var/log/mpd.log is rotated and compressed at midnigt only. > >> Note, that compressing the file takes 8 minutes. > ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ > > > I have three things to say on the matter, all of which are somewhat > > Five things really :-) > > > independent of one another so please keep that in mind. I imagine #1 > > below is your problem. > > > > 1) The newsyslog.conf(5) man page has this clause in it, for the "when" > > field (in your case, @T0000): > > > > when ... If the when field contains an asterisk (`*'), log rotation > > will solely depend on the contents of the size field. Otherwise, > > the when field consists of an optional interval in hours, usually > > followed by an `@'-sign and a time in restricted ISO 8601 format. > > > > If a time is specified, the log file will only be trimmed if > > newsyslog(8) is run within one hour of the specified time. If an > > interval is specified, the log file will be trimmed if that many > > hours have passed since the last rotation. ... > > > > You might think that "one hour of the specified time" value/clause > > correlates with the interval that newsyslog is run at via cron, but that > > would be wrong. newsyslog REALLY DOES have hard-coded values for 3600 > > seconds (1 hour) in it (grep -r 3600 /usr/src/usr.sbin/newsyslog). I > > have not looked at the code, but the fact of the matter is, 1 hour > > appears to be a "special" value. I would heed that as a warning. > > > > 2) Are you absolutely sure mpd.log is being rotated AND compressed within > > the 5 minute window? If mpd.log is extremely large and your disks are > > slow, this could take a long time. If possible, try (temporarily) > > removing bzip2 from the picture (remove J flag). > > I've noted (see above) that compression takes 8 minutes. > I just think newsyslog should not deal with the file at 00:05. > > > 3) mpd(8) logs via syslog(3). When newsyslog(8), are you aware that it > > sends a SIGHUP to syslogd(8)? As such, are you absolutely certain when > > this happen (every 5 minutes!) that the new log files are getting > > created correctly and promptly? > > I see no other problems. > > > 4) To debug this, you're probably going to need to run some cronjobs or > > daemons that keep a very close eye on /var/log/mpd.log* when the log > > rotation runs, in combination with running syslogd(8) in debug mode > > and/or verbose mode. > > syslogd or newsyslo needs debug mode? > > > 5) Why do you need to rotate logs every 5 minutes? Why do you need such > > extreme levels of granularity in your rotated logs? Just how much data > > are you logging via syslog? If a lot, why so much? It might be more > > effective to consider expanding your logging infrastructure to multiple > > machines if this the case. > > Most of my boxes are diskless NanoBSD installations having /var in memory > and I need very detailed debug logs that grow quickly. These logs > can easily overflow /var partition in case of network problems (storms etc.) > so newsyslog have to check them often. > > And I have another router that has an HDD to keep daily log and I'd like > to have their crontabs unified. > > Eugene Grosbein > > _______________________________________________ > freebsd-stable@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-stable > To unsubscribe, send any mail to "freebsd-stable-unsubscribe@freebsd.org" [-- Attachment #2 --] -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.17 (FreeBSD) Comment: http://bit.ly/0x89D8547E iQEcBAEBAgAGBQJONhH0AAoJEJBXh4mJ2FR+mCEIAJnZNnh9S5R8c6mR1PMEuxMY GHgaNU5no0mSm5X2w3k0+4jxJ2L4PM53QILNb/A/RCvCd5/fiMbNNmtZgQ1Yatm+ cdH0pQINYnKH5BWeKqWkKcwK7PjGnWRb71kgoxiLIik/eDFpZjNo//Y8X5BcnSAQ GkeIRC50CNaf9vd+KnDDV1WkBVJsbWLCAI4ewSezsW8r/4ZxsNM3zVdO5780GbUf FEnoZfzoEoex/fuEQ80iEXn1xwMCnSXYGMVt9UqMAX4qgliAjpkvP0Ok5gXdJ9p5 A9g+37WMX5qDlZxuO7zfi5ZZ5dHl1YU/koZFUdakbvELgojOLM3FUoj64HQTK60= =0yyt -----END PGP SIGNATURE-----
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20110801023948.GA77144>