dmesg.today->dmesg.yesterday

[Jesse Guardiani]

Lowell Gilbert wrote:

> Jesse Guardiani <jesse at wingnet.net> writes:
> 
>> How does dmesg.today get rotated to dmesg.yesterday?
>> 
>> I suspect my dmesg.today of being corrupted by old info.
>> I have gotten the following message in my security output
>> for the last four days:
>> 
>> pid 4062 (clamd), uid 3848: exited on signal 11
>> 
>> It appears in different places, but what are the chances of
>> clamd acquiring pid 4062 four days in a row?
> 
> That diff is taken as part of the periodic/security checks.
> I don't think it uses dmesg.today, though; I think it takes output
> directly from dmesg(8)...

>From /etc/periodic/security/security.functions:


-------------------------------------------------------------------
# Usage: COMMAND | check_diff [new_only] LABEL - MSG
#        COMMAND > TMPFILE; check_diff [new_only] LABEL TMPFILE MSG
#   if $1 is new_only, show only the 'new' part of the diff.
#   LABEL is the base name of the ${LOG}/${label}.{today,yesterday} files.

check_diff() {
-------------------------------------------------------------------

It would appear that it does indeed use .today and .yesterday.

And I think I just answered my own question. check_diff is the
function that creates the dmesg.today and dmesg.yesterday files,
and is in charge of rotating them.

Thanks.

-- 
Jesse Guardiani, Systems Administrator
WingNET Internet Services,
P.O. Box 2605 // Cleveland, TN 37320-2605
423-559-LINK (v)  423-559-5145 (f)
http://www.wingnet.net