Date: Sun, 31 Jul 2011 22:39:48 -0400 From: Jason Hellenthal <jhell@DataIX.net> To: Eugene Grosbein <egrosbein@rdtc.ru> Cc: stable@freebsd.org, Jeremy Chadwick <freebsd@jdc.parodius.com> Subject: Re: running newsyslog fiveminly Message-ID: <20110801023948.GA77144@DataIX.net> In-Reply-To: <4E359753.3050004@rdtc.ru> References: <4E35881C.2010505@rdtc.ru> <20110731173129.GA53635@icarus.home.lan> <4E359753.3050004@rdtc.ru>
next in thread | previous in thread | raw e-mail | index | archive | help
--k1lZvvs/B4yU6o8G Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable What line of the newsyslog.conf file is your line inserted and can you move that to a higher line number. FIFO On Mon, Aug 01, 2011 at 12:56:35AM +0700, Eugene Grosbein wrote: > 01.08.2011 00:31, Jeremy Chadwick writes: >=20 > >> For second kind of logs we have lines in newsyslog.conf such as follow= ing: > >> > >> /var/log/mpd.log 640 16 * @T0000 JC > >> > >> This must ensure that /var/log/mpd.log is rotated and compressed at mi= dnigt only. > >> Note, that compressing the file takes 8 minutes. > ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ >=20 > > I have three things to say on the matter, all of which are somewhat >=20 > Five things really :-) >=20 > > independent of one another so please keep that in mind. I imagine #1 > > below is your problem. > >=20 > > 1) The newsyslog.conf(5) man page has this clause in it, for the "when" > > field (in your case, @T0000): > >=20 > > when ... If the when field contains an asterisk (`*'), log rot= ation > > will solely depend on the contents of the size field. Oth= erwise, > > the when field consists of an optional interval in hours, = usually > > followed by an `@'-sign and a time in restricted ISO 8601 = format. > >=20 > > If a time is specified, the log file will only be trimmed = if > > newsyslog(8) is run within one hour of the specified time.= If an > > interval is specified, the log file will be trimmed if tha= t many > > hours have passed since the last rotation. ... > >=20 > > You might think that "one hour of the specified time" value/clause > > correlates with the interval that newsyslog is run at via cron, but that > > would be wrong. newsyslog REALLY DOES have hard-coded values for 3600 > > seconds (1 hour) in it (grep -r 3600 /usr/src/usr.sbin/newsyslog). I > > have not looked at the code, but the fact of the matter is, 1 hour > > appears to be a "special" value. I would heed that as a warning. > >=20 > > 2) Are you absolutely sure mpd.log is being rotated AND compressed with= in > > the 5 minute window? If mpd.log is extremely large and your disks are > > slow, this could take a long time. If possible, try (temporarily) > > removing bzip2 from the picture (remove J flag). >=20 > I've noted (see above) that compression takes 8 minutes. > I just think newsyslog should not deal with the file at 00:05. >=20 > > 3) mpd(8) logs via syslog(3). When newsyslog(8), are you aware that it > > sends a SIGHUP to syslogd(8)? As such, are you absolutely certain when > > this happen (every 5 minutes!) that the new log files are getting > > created correctly and promptly? >=20 > I see no other problems. >=20 > > 4) To debug this, you're probably going to need to run some cronjobs or > > daemons that keep a very close eye on /var/log/mpd.log* when the log > > rotation runs, in combination with running syslogd(8) in debug mode > > and/or verbose mode. >=20 > syslogd or newsyslo needs debug mode? >=20 > > 5) Why do you need to rotate logs every 5 minutes? Why do you need such > > extreme levels of granularity in your rotated logs? Just how much data > > are you logging via syslog? If a lot, why so much? It might be more > > effective to consider expanding your logging infrastructure to multiple > > machines if this the case. >=20 > Most of my boxes are diskless NanoBSD installations having /var in memory > and I need very detailed debug logs that grow quickly. These logs > can easily overflow /var partition in case of network problems (storms et= c.) > so newsyslog have to check them often. >=20 > And I have another router that has an HDD to keep daily log and I'd like > to have their crontabs unified. >=20 > Eugene Grosbein >=20 > _______________________________________________ > freebsd-stable@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-stable > To unsubscribe, send any mail to "freebsd-stable-unsubscribe@freebsd.org" --k1lZvvs/B4yU6o8G Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.17 (FreeBSD) Comment: http://bit.ly/0x89D8547E iQEcBAEBAgAGBQJONhH0AAoJEJBXh4mJ2FR+mCEIAJnZNnh9S5R8c6mR1PMEuxMY GHgaNU5no0mSm5X2w3k0+4jxJ2L4PM53QILNb/A/RCvCd5/fiMbNNmtZgQ1Yatm+ cdH0pQINYnKH5BWeKqWkKcwK7PjGnWRb71kgoxiLIik/eDFpZjNo//Y8X5BcnSAQ GkeIRC50CNaf9vd+KnDDV1WkBVJsbWLCAI4ewSezsW8r/4ZxsNM3zVdO5780GbUf FEnoZfzoEoex/fuEQ80iEXn1xwMCnSXYGMVt9UqMAX4qgliAjpkvP0Ok5gXdJ9p5 A9g+37WMX5qDlZxuO7zfi5ZZ5dHl1YU/koZFUdakbvELgojOLM3FUoj64HQTK60= =0yyt -----END PGP SIGNATURE----- --k1lZvvs/B4yU6o8G--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20110801023948.GA77144>