syslog log rotation

[Alex Kiernan]

Russ Allbery <rra at stanford.edu> writes:

> > Is it worth figuring how to integrate this cleanly, or should I just
> > make hupsyslogd.c available for dropping into contrib?
> 
> To my mind, the fundamental problem here is that INN is attempting to
> handle rotation of syslog files, which is something that shouldn't be done
> by a user other than root (since syslogd needs to be HUP'd).

Yup.

> So rather than trying to add various log rotation policy stuff into
> scanlogs, what I'd really love to see is to provide some way of getting
> scanlogs out of the loop entirely, and try to make all the log rotation
> stuff optional.  Then those of us with our own software to handle such
> things can use it and point INN at the results for its nightly summaries.
> 
> So under my thought, scanlogs would only handle those logs written
> directly by INN, like the news log, and leave the syslog logs to some
> other mechanism.
> 
> The difficulty with this idea is that scanlogs also coordinates the
> rotation of logs with pausing the server and flushing logs so that one
> gets a consistent snapshot of the server state.  But most log rotation
> programs have ways of running programs before and after the actual log
> rotation.
> 

But not this newsyslog:

        <http://www.weird.com/~woods/projects/newsyslog.html>

which is what we happen to use :( It will though send a signal to a
process you have a pid file for.

> So my thought is this:  Continue to maintain the code in scanlogs to do
> the work that it currently does, but also add two different modes, one to
> flush the logs in the server and get ready for syslog logs to be rotated,
> and one to do all the work done after the logs have been rotated, setting
> things up for reporting.  And pull the reporting portions out of scanlogs
> into a separate program.
> 
> Then, if you want, you can continue doing things as now.  Or you can tell
> news.daily to not run log rotation, run log rotation yourself before
> news.daily runs, and then tell news.daily to just use the results.
> 
> Does that make sense?  Do people think that would be a workable approach?
> 

Sounds reasonable to me.

-- 
Alex Kiernan, Principal Engineer, Development, THUS plc