syslog log rotation

[Alex Kiernan]

We've a recurrent problem when scanlogs runs overnight on a box which
has all its disk NFS mounted (a NetApp). When syslog rotation happens
the way Solaris & NFS interact causes us to get files, immediately
post rotation, which are exactly the same size as those before, but
entirely filled with zeroes (could be holes, I haven't checked), they
then grow from the end of those files (albeit with some corruption in
the first real block).

The solution is to not use this chunk from scanlogs:

    ##  Copy syslog files, truncating old inode since syslog has it open.
    for F in ${SYSLOGS}; do
 	rm -f ${F}.old
	cp ${F} ${F}.old
	cat /dev/null >${F}
    done
    ctlinnd -s logmode

but instead do something like this:

    ##  Move syslog files.
    for F in ${SYSLOGS}; do
 	rm -f ${F}.old
	mv ${F} ${F}.old
	cat /dev/null >${F}
    done
    hupsyslogd
    ctlinnd -s logmode

where hupsyslogd is a news only setuid root program which sends a
SIGHUP to syslogd (using a compiled in path to a syslogd.pid type
file).

Is it worth figuring how to integrate this cleanly, or should I just
make hupsyslogd.c available for dropping into contrib?

-- 
Alex Kiernan, Principal Engineer, Development, Thus PLC