My predecessor uninstalled the Urchin software from our RHEL5 server, but this /var/log/httpd/sea_urchin log keeps regenerating every Monday. We cannot figure out why. I am assuming it has something to do with logrotate. I am newbie, so be gentle. How can I stop it? Is there something we are overlooking?

Thanks
Tasha

If it is regenerating every Monday it is likely due to a cron job.

The first place I'd check is /etc/cron.weekly and see if any of the files underneath that (they are simple text files) has anything that is doing the generation of the log.

If not there then it might be using a standard crontab file. If you look in /var/spool/cron you may see files named for users on your system (including "root"). These are also simple text files and you can check those to see if any are doing the generation of the log. (Note - do not edit the files here - use "crontab -e" command to edit - see "man cron" for more details.) The fifth space separated field in the file is the day of the week to run on - you're interested in (day) 1 which is Monday.

Also be aware that either of the above cron methods above might actually be calling a script that is doing this and it may not be obvious which script so you might have to dig into the things you find. (i.e. If he called the script myfun.sh there isn't anything obvious in that name that would let you know it relates to sea_urchin so you'd have to review myfun.sh to see if it does that - this can get tedious if myfun.sh itself calls another script which calls another and so on ....)