running newsyslog fiveminly

[Jason Hellenthal]

What line of the newsyslog.conf file is your line inserted and can you
move that to a higher line number. FIFO

On Mon, Aug 01, 2011 at 12:56:35AM +0700, Eugene Grosbein wrote:
> 01.08.2011 00:31, Jeremy Chadwick writes:
> 
> >> For second kind of logs we have lines in newsyslog.conf such as following:
> >>
> >> /var/log/mpd.log 640 16 * @T0000  JC
> >>
> >> This must ensure that /var/log/mpd.log is rotated and compressed at midnigt only.
> >> Note, that compressing the file takes 8 minutes.
>    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> 
> > I have three things to say on the matter, all of which are somewhat
> 
> Five things really :-)
> 
> > independent of one another so please keep that in mind.  I imagine #1
> > below is your problem.
> > 
> > 1) The newsyslog.conf(5) man page has this clause in it, for the "when"
> > field (in your case, @T0000):
> > 
> >      when    ...  If the when field contains an asterisk (`*'), log rotation
> >              will solely depend on the contents of the size field.  Otherwise,
> >              the when field consists of an optional interval in hours, usually
> >              followed by an `@'-sign and a time in restricted ISO 8601 format.
> > 
> >              If a time is specified, the log file will only be trimmed if
> >              newsyslog(8) is run within one hour of the specified time.  If an
> >              interval is specified, the log file will be trimmed if that many
> >              hours have passed since the last rotation. ...
> > 
> > You might think that "one hour of the specified time" value/clause
> > correlates with the interval that newsyslog is run at via cron, but that
> > would be wrong.  newsyslog REALLY DOES have hard-coded values for 3600
> > seconds (1 hour) in it (grep -r 3600 /usr/src/usr.sbin/newsyslog).  I
> > have not looked at the code, but the fact of the matter is, 1 hour
> > appears to be a "special" value.  I would heed that as a warning.
> > 
> > 2) Are you absolutely sure mpd.log is being rotated AND compressed within
> > the 5 minute window?  If mpd.log is extremely large and your disks are
> > slow, this could take a long time.  If possible, try (temporarily)
> > removing bzip2 from the picture (remove J flag).
> 
> I've noted (see above) that compression takes 8 minutes.
> I just think newsyslog should not deal with the file at 00:05.
> 
> > 3) mpd(8) logs via syslog(3).  When newsyslog(8), are you aware that it
> > sends a SIGHUP to syslogd(8)?  As such, are you absolutely certain when
> > this happen (every 5 minutes!) that the new log files are getting
> > created correctly and promptly?
> 
> I see no other problems.
> 
> > 4) To debug this, you're probably going to need to run some cronjobs or
> > daemons that keep a very close eye on /var/log/mpd.log* when the log
> > rotation runs, in combination with running syslogd(8) in debug mode
> > and/or verbose mode.
> 
> syslogd or newsyslo needs debug mode?
> 
> > 5) Why do you need to rotate logs every 5 minutes?  Why do you need such
> > extreme levels of granularity in your rotated logs?  Just how much data
> > are you logging via syslog?  If a lot, why so much?  It might be more
> > effective to consider expanding your logging infrastructure to multiple
> > machines if this the case.
> 
> Most of my boxes are diskless NanoBSD installations having /var in memory
> and I need very detailed debug logs that grow quickly. These logs
> can easily overflow /var partition in case of network problems (storms etc.)
> so newsyslog have to check them often.
> 
> And I have another router that has an HDD to keep daily log and I'd like
> to have their crontabs unified.
> 
> Eugene Grosbein
> 
> _______________________________________________
> freebsd-stable at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-stable
> To unsubscribe, send any mail to "freebsd-stable-unsubscribe at freebsd.org"
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 522 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-stable/attachments/20110801/9e4b9cc4/attachment.pgp