Mikkel L. Ellertson wrote:
Vivek J. Patankar wrote:
I hope you realise that if set to daily, logrotate happens at 4:02AM.
That means yesterday's log actually contains 4 hours of 'today' and is
missing 4 hours from yesterday.
If you run automated report generation from the logs, eg. SARG, the
report will be incomplete unless the utility that generates reports is
aware of log rotation and takes it into consideration.
This can be changed - either change the entry in /etc/crontab, or
remove logrotate from /etc/cron.daily and put an entry in
/etc/cron.d to run it at 12:01 or something like that.
Doesn't quite work for me. I have SARG generate daily reports for my
proxy usage and if logrotate happens before the SARG process is started,
then it generates reports from what is currently in access.log, ie. it's
doesn't fetch data from the rotated logs. Other utilities for log
analysis may behave differently.
--
Regards,
विवेक ज. पाटणकर (Vivek J. Patankar)
Registered Linux User #374218
Fedora release 7 (Moonshine)
Linux 2.6.22.1-33.fc7 x86_64
