jim martin wrote:
--- jim martin <postfix168@xxxxxxxxx> wrote:
--- Paul Howarth <paul@xxxxxxxxxxxx> wrote:
On Thu, 2006-10-12 at 10:56 -0700, jim martin wrote:
Hi.. Anyone used swatch before? I follow the
instruction to run swatch process via the following
command. It will detect the interesting entries in
/var/log/messages and send email to me
/usr/bin/perl /usr/bin/swatch
--config-file=/var/log/swatchrc1
--tail-file=/var/log/messages &
However, I always found that the email stop sending
after a few days. When I go to ps -ef , the swatch
process is still listed there as below. I just need
to kill it and restart the command. The emsil will
start sending again. Why it stop ?? Anyone know ?
Any idea how to solve it?
[root@watcher ~]# ps -ef | grep swatch
root 31442 1 0 Oct04 ? 00:00:00
/usr/bin/perl /usr/bin/swatch
--config-file=/var/log/swatchrc1
--tail-file=/var/log/centrallog
root 31444 31442 0 Oct04 ? 00:00:00
/usr/bin/perl /root/.swatch_script.31442
Does "after a few days" coincide with midnight or so on Saturday night
when the log files get rotated?
Paul.
Sorry No. Should I add a "nohup" in frout of the "/usr/bin/perl /usr/bin/swatch
--config-file=/var/log/swatchrc1 --tail-file=/var/log/messages &" to solve this issue ?
#nohup /usr/bin/perl /usr/bin/swatch --config-file=/var/log/swatchrc1
--tail-file=/var/log/messages &
Sorry, Paul, you are right actually the email stop sending after the log files got rotated. Do
you know why ? Any solution for that ?
I'm not familiar with swatch; it might have some built-in functionality
that can handle that (e.g. it might reopen the files if you send it a
signal of some sort). Failing that, you probably need to restart swatch
in the postrotate script of logwatch.
Paul.
