Re: No syslog entries on Sunday's & Monday's

From: Ian Wilson (scobloke2_at_infotop.co.uk)
Date: 11/18/03 

Date: Tue, 18 Nov 2003 10:42:24 +0000 (UTC)

Fabio Giannotti wrote:

>
>>-----Original Message-----
>>From: listmaster@xenitec.on.ca [mailto:listmaster@xenitec.on.ca]On
>>Behalf Of Gary Quiring
>>Sent: Monday, November 17, 2003 2:06 PM
>>To: distribution@xenitec.on.ca
>>Subject: No syslog entries on Sunday's & Monday's
>>
>>
>>I have a SCO 5.0.6 server. I have a script that moves the
>>syslog daily. For
>>some reason there are never any entries in there on Sunday
>>and Monday. I am not
>>sure if the script is causing the problem. Right now
>>(Monday) if I review the
>>/var/adm/syslog it is zero bytes. This is not right as my
>>FTP server logs all
>>details to syslog.
>>
>>script:
>>mv /var/adm/syslog /u/logs/ftpxfers/syslog.`date +\%m\%d`
>>
>>>/var/adm/syslog
>>
>>root cron entry:
>>59 23 * * * /u/bin/movesyslog >/dev/null 2>&1
>>
>>/etc/syslog.conf:
>>*.debug /usr/adm/syslog
>>
>
> Not sure, but I think you need to restart (kill -1) syslog to get it writing
> to the "new" file even though it's the same name as the "old" file.
>

Yes, the way I understand it, certain daemons hold their logfiles open
permanently rather than opening and closing for each write.

If you rename the logfile (mv to same fs), the deamon will keep writing
to the same file (inode) despite its change of name. The daemon won't
even notice there has been any change. In this case you'll get extra
data seemingly appended to a specific days file, e.g. wed+thu data in a
weds file.

If you delete the file (mv across fs), the daemon will continue to write
to the "deleted" file. The file has no directory entry but has space
allocated in the inode tables etc. The actual deletion of data only
occurs when the daemon finally releases the file. In this latter case
you'll lose the data.

So generally you should signal the daemon when renaming, moving or
deleting its log file. Usually a HUP signal causes a daemon to reload
its config and to close and reopen its log files, but check man pages
for the specific daemon (i.e. syslog).

Relevant Pages