Vivek J. Patankar wrote: > Mikkel L. Ellertson wrote: >> Vivek J. Patankar wrote: >>> I hope you realise that if set to daily, logrotate happens at 4:02AM. >>> That means yesterday's log actually contains 4 hours of 'today' and is >>> missing 4 hours from yesterday. >>> If you run automated report generation from the logs, eg. SARG, the >>> report will be incomplete unless the utility that generates reports is >>> aware of log rotation and takes it into consideration. >>> >> This can be changed - either change the entry in /etc/crontab, or >> remove logrotate from /etc/cron.daily and put an entry in >> /etc/cron.d to run it at 12:01 or something like that. > > Doesn't quite work for me. I have SARG generate daily reports for my > proxy usage and if logrotate happens before the SARG process is started, > then it generates reports from what is currently in access.log, ie. it's > doesn't fetch data from the rotated logs. Other utilities for log > analysis may behave differently. > Well, you could run a daily cron job that pulls everything with yesterday's date out of the log and the rotated log, and puts the results in a file with the correct date as part of the name. Or, if you want to archive the entire month in one file, append the output to a fine. Then have a monthly job that renames the file to the correct mouth and year, and create a new, empty file to collect the next month's job. That way, the daily cron job doesn't have to know the month. Mikkel -- Do not meddle in the affairs of dragons, for thou art crunchy and taste good with Ketchup!
Attachment:
signature.asc
Description: OpenPGP digital signature
