[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

problem with syslog and logratote script



Hey there y'all.

Let's see... I have a Sonicwall firewall that is sending it's data to my linux
box via local0.

Here is the pertinent line in /etc/syslog.conf:

local0.*		/var/log/sonicwall/log

Here is /etc/logrotate.conf (I removed all unnecessary lines):

weekly
rotate 8
create
include /etc/logrotate.d

/var/log/wtmp {
    monthly
    create 0664 root utmp
    rotate 1
}

/var/log/sonicwall/log {
    daily
    rotate 7
    create
    compress
}

For about one day the file /var/log/sonicwall/log increased in size (as it
should) as the sonicwall entries were inserted into it. After that day when the
logrotate script ran it created a log.1.gz file. This of course is because of
the "compress" option. BUT!! After that, the /var/log/sonicwall/log file stopped
increasing in size because it wasn't having any entries put into it.

Now, in the directory /var/log/sonicwall directory I've got three files:

-rw-r-----    1 root     root            0 Jul 11 04:02 log
-rw-r-----    1 root     root           26 Jul 10 04:02 log.1.gz
-rw-r-----    1 root     root       864967 Jul 10 04:02 log.2.gz

log.2.gz was the one that was created and working successfully, log.1.gz was
from yesterday and now today there is just plain log. I bet tomorrow I will see
this:

-rw-r-----    1 root     root            0 Jul 12 04:02 log
-rw-r-----    1 root     root           26 Jul 10 04:02 log.1.gz
-rw-r-----    1 root     root           26 Jul 10 04:02 log.2.gz
-rw-r-----    1 root     root       864967 Jul 10 04:02 log.3.gz


Anyone have any ideas?


Thanks,
Chris.




[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]