Re: running newsyslog fiveminly

--k1lZvvs/B4yU6o8G
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

What line of the newsyslog.conf file is your line inserted and can you
move that to a higher line number. FIFO

On Mon, Aug 01, 2011 at 12:56:35AM +0700, Eugene Grosbein wrote:
> 01.08.2011 00:31, Jeremy Chadwick writes:
>=20
> >> For second kind of logs we have lines in newsyslog.conf such as follow=
ing:
> >>
> >> /var/log/mpd.log 640 16 * @T0000  JC
> >>
> >> This must ensure that /var/log/mpd.log is rotated and compressed at mi=
dnigt only.
> >> Note, that compressing the file takes 8 minutes.
>    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>=20
> > I have three things to say on the matter, all of which are somewhat
>=20
> Five things really :-)
>=20
> > independent of one another so please keep that in mind.  I imagine #1
> > below is your problem.
> >=20
> > 1) The newsyslog.conf(5) man page has this clause in it, for the "when"
> > field (in your case, @T0000):
> >=20
> >      when    ...  If the when field contains an asterisk (`*'), log rot=
ation
> >              will solely depend on the contents of the size field.  Oth=
erwise,
> >              the when field consists of an optional interval in hours, =
usually
> >              followed by an `@'-sign and a time in restricted ISO 8601 =
format.
> >=20
> >              If a time is specified, the log file will only be trimmed =
if
> >              newsyslog(8) is run within one hour of the specified time.=
  If an
> >              interval is specified, the log file will be trimmed if tha=
t many
> >              hours have passed since the last rotation. ...
> >=20
> > You might think that "one hour of the specified time" value/clause
> > correlates with the interval that newsyslog is run at via cron, but that
> > would be wrong.  newsyslog REALLY DOES have hard-coded values for 3600
> > seconds (1 hour) in it (grep -r 3600 /usr/src/usr.sbin/newsyslog).  I
> > have not looked at the code, but the fact of the matter is, 1 hour
> > appears to be a "special" value.  I would heed that as a warning.
> >=20
> > 2) Are you absolutely sure mpd.log is being rotated AND compressed with=
in
> > the 5 minute window?  If mpd.log is extremely large and your disks are
> > slow, this could take a long time.  If possible, try (temporarily)
> > removing bzip2 from the picture (remove J flag).
>=20
> I've noted (see above) that compression takes 8 minutes.
> I just think newsyslog should not deal with the file at 00:05.
>=20
> > 3) mpd(8) logs via syslog(3).  When newsyslog(8), are you aware that it
> > sends a SIGHUP to syslogd(8)?  As such, are you absolutely certain when
> > this happen (every 5 minutes!) that the new log files are getting
> > created correctly and promptly?
>=20
> I see no other problems.
>=20
> > 4) To debug this, you're probably going to need to run some cronjobs or
> > daemons that keep a very close eye on /var/log/mpd.log* when the log
> > rotation runs, in combination with running syslogd(8) in debug mode
> > and/or verbose mode.
>=20
> syslogd or newsyslo needs debug mode?
>=20
> > 5) Why do you need to rotate logs every 5 minutes?  Why do you need such
> > extreme levels of granularity in your rotated logs?  Just how much data
> > are you logging via syslog?  If a lot, why so much?  It might be more
> > effective to consider expanding your logging infrastructure to multiple
> > machines if this the case.
>=20
> Most of my boxes are diskless NanoBSD installations having /var in memory
> and I need very detailed debug logs that grow quickly. These logs
> can easily overflow /var partition in case of network problems (storms et=
c.)
> so newsyslog have to check them often.
>=20
> And I have another router that has an HDD to keep daily log and I'd like
> to have their crontabs unified.
>=20
> Eugene Grosbein
>=20
> _______________________________________________
> freebsd-stable@freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-stable
> To unsubscribe, send any mail to "freebsd-stable-unsubscribe@freebsd.org"

--k1lZvvs/B4yU6o8G
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.17 (FreeBSD)
Comment: http://bit.ly/0x89D8547E

iQEcBAEBAgAGBQJONhH0AAoJEJBXh4mJ2FR+mCEIAJnZNnh9S5R8c6mR1PMEuxMY
GHgaNU5no0mSm5X2w3k0+4jxJ2L4PM53QILNb/A/RCvCd5/fiMbNNmtZgQ1Yatm+
cdH0pQINYnKH5BWeKqWkKcwK7PjGnWRb71kgoxiLIik/eDFpZjNo//Y8X5BcnSAQ
GkeIRC50CNaf9vd+KnDDV1WkBVJsbWLCAI4ewSezsW8r/4ZxsNM3zVdO5780GbUf
FEnoZfzoEoex/fuEQ80iEXn1xwMCnSXYGMVt9UqMAX4qgliAjpkvP0Ok5gXdJ9p5
A9g+37WMX5qDlZxuO7zfi5ZZ5dHl1YU/koZFUdakbvELgojOLM3FUoj64HQTK60=
=0yyt
-----END PGP SIGNATURE-----

--k1lZvvs/B4yU6o8G--