logrotate question

sunman · 02-21-2006, 10:07 AM

I just installed clamav on my system here at home and have set up freshclam and verified that it works alright. I then added a tiny script in /etc/cron.daily to run it once a day quietly, but I figured it'd be nice to be able to see the log for it so I made one in /var/log and edited the configuration file so for freshclam so that it's written to when I run freshclam --quiet. Verified that the logging is working alright, so then I decided to try and make the logs so that they will rotate weekly and this is where I have a couple of questions.

First, I looked at the manpage for logrotate and it gives an example configuration file, with entries such as:

Code:

/var/log/messages {
    rotate 5
    weekly
    postrotate
                              /sbin/killall -HUP syslogd
    endscript
}

What exactly is the kill being used for and why?

I assumed that possibly it has something to do with the fact that the log file is in use by the daemon, but I have no idea really.

Next, I don't believe that for my entry in logrotate.conf that I'd need to kill anything as I've seen for other entries because I'm not running freshclam as a daemon, but as a daily cron job. But do I need to actually kill anything?

My entry after reading the man page for logrotate looks like this:

Code:

# Rotate the clamav update log
/var/log/freshclam.log {
    weekly
    create 0600 clamav clamav
    rotate 4
}

Will that work alright or am I missing anything?

Thanks a lot for any help, just want to make sure I'm doing this correctly.

gilead · 02-21-2006, 01:36 PM

You are correct, the syslog daemon is being re-started because /var/log/messages was in use. You are also correct that since freshclam runs out of cron, opens and then closes a log file, that you won't need to kill freshclam.

Comparing your logrotate entry to the man page: You want to rotate the /var/log/freshclam.log weekly and have 4 archive copies with all of the files created with the permissions 0600, owned by clamav and in the clamav group. If that's what you want to do - then you're set...

sunman · 02-21-2006, 01:38 PM

Thanks for replying, and yes that's what I was aiming for as far as backing up the logs. I did some more research and found that sending the HUP signals is usually to cause a program to reread it's configuration files, which I figured, for the programs that use it, is what causes the new log file to be generated.

Just wanting to make sure I understand things

Thanks again.

cwwilson721 · 02-21-2006, 01:40 PM

It has to kill the process to make sure that it won't get into something close to a brother/sister fight over the remote for the TV. If you unplug the TV, no fight over the remote....No process, no fight over the log.

I always compare computers/OS's to children.....I'm getting way too old. lol