[RFC] How should rsyslog handle .0 logfiles from sysklogd - Debian

This is a discussion on [RFC] How should rsyslog handle .0 logfiles from sysklogd - Debian ; Hi, as rsyslog will be our default syslogd for lenny, I'd like to fix bug #491672 [1], I'm just undecided about which solution is best. rsyslog, in contrast to sysklogd, uses logrotate to rotate the default log files. Unfortunately sysklogd ...

+ Reply to Thread
Results 1 to 12 of 12

Thread: [RFC] How should rsyslog handle .0 logfiles from sysklogd

  1. [RFC] How should rsyslog handle .0 logfiles from sysklogd

    Hi,

    as rsyslog will be our default syslogd for lenny, I'd like to fix bug
    #491672 [1], I'm just undecided about which solution is best.

    rsyslog, in contrast to sysklogd, uses logrotate to rotate the default
    log files. Unfortunately sysklogd uses a custom log rotate mechanism,
    which starts the log rotate cycle at .0
    The default logrotate configuration starts the log rotate cyle at .1.

    This leaves .0 files around when you switch from sysklogd to rsyslog [2]
    which will never be rotated.

    Afaics I have the following options.
    1.) Do nothing and simply document this fact in README.Debian, telling
    the admin that he can safely delete this files if he no longer needs them.

    2.) Try to log rotate the .0 files for the default Debian log files in
    postinst. I feel a bit uneasy about this approach, for several reasons:
    - It adds fairly reasonable complexity to the maintainer scripts, if you
    want to consider all corner cases.
    E.g. if you switch from syslog-ng to rsyslog, it is very likely that you
    have old .0 files lying around (from a sysklogd->syslog-ng switch), so
    syslog.1 would be older than syslog.2 which would be very confusing.

    3.) Delete the .0 files in postinst. Is this covered by the policy?

    4.) Use start 0 in /etc/logrotate.d/rsyslog, which would retain old
    sysklogd behaviour. This would mean, that it would still be incompatible
    with all other syslog alternatives [2] besides old sysklogd. That's why
    I'd keep the logrotate standard configuration.


    I'm leaning towards 1.) or 3.), although the latter would mean deleting
    a log file and I'm not sure everyone would be happy about that (on the
    other hand 2.) would simply mean I have to delete .6.gz/3.gz instead of .0)

    Is there anything else to consider, did I miss another option?

    I'd be very thankful for your comments and feedback.


    Cheers,
    Michael


    [1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=491672
    [2] Or to any other syslog alternative, like syslog-ng, dsyslog or
    inetutils-syklogd, as they also use the standard logrotate configuration.
    --
    Why is it that all of the instruments seeking intelligent life in the
    universe are pointed away from Earth?


    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.4.9 (GNU/Linux)
    Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

    iEYEARECAAYFAkjUIGYACgkQh7PER70FhVTJ2wCgpB8w0M2Nfs B0PE3qqFntrlW5
    hvgAoLokBOm4O1zMMkMfc0DtzUlMBBXj
    =cQ8w
    -----END PGP SIGNATURE-----


  2. Re: [RFC] How should rsyslog handle .0 logfiles from sysklogd

    Michael Biebl wrote:
    > 2.) Try to log rotate the .0 files for the default Debian log files in
    > postinst. I feel a bit uneasy about this approach, for several reasons:
    > - It adds fairly reasonable complexity to the maintainer scripts, if you
    > want to consider all corner cases.
    > E.g. if you switch from syslog-ng to rsyslog, it is very likely that you
    > have old .0 files lying around (from a sysklogd->syslog-ng switch), so
    > syslog.1 would be older than syslog.2 which would be very confusing.

    Well, you could rely on ctime for this, even though this would make
    postinst even more complex; any other reasons?

    > 3.) Delete the .0 files in postinst. Is this covered by the policy?

    I think that deleting logfiles without warning is totally unacceptable.

    Regards,
    Faidon


    --
    To UNSUBSCRIBE, email to debian-devel-REQUEST@lists.debian.org
    with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

  3. Re: [RFC] How should rsyslog handle .0 logfiles from sysklogd

    Hi,

    2008/9/19 Michael Biebl :
    > rsyslog, in contrast to sysklogd, uses logrotate to rotate the default
    > log files. Unfortunately sysklogd uses a custom log rotate mechanism,
    > which starts the log rotate cycle at .0
    > The default logrotate configuration starts the log rotate cyle at .1.


    ah, cool. :-)

    > This leaves .0 files around when you switch from sysklogd to rsyslog [2]
    > which will never be rotated.
    >
    > Afaics I have the following options.
    > 1.) Do nothing and simply document this fact in README.Debian, telling
    > the admin that he can safely delete this files if he no longer needs them.


    Hm. Thats probably a safe way. It does not include acting on files
    which are in the interest of the local admin without asking him first.
    Unfortunately it also means that the admin probably never pays
    attention for the logfile (and that he needs to know, which syslog is
    installed, so where to find the README.Debian but I guess we can
    assume that...). I'm a bit uneasy about that last thing, but general
    this is a valid approach.

    > 2.) Try to log rotate the .0 files for the default Debian log files in
    > postinst. I feel a bit uneasy about this approach, for several reasons:


    What does this mean, excatly? You try to log rotate like it would be
    normally done by logrotate? Hm. Probably what the user would expect,
    but I guess that way is over-complex.

    > 3.) Delete the .0 files in postinst. Is this covered by the policy?


    Not without a backup or asking the user first. You could ask the user
    via debconf. I think this is a case, which would justify it.

    > 4.) Use start 0 in /etc/logrotate.d/rsyslog, which would retain old
    > sysklogd behaviour. This would mean, that it would still be incompatible
    > with all other syslog alternatives [2] besides old sysklogd. That's why
    > I'd keep the logrotate standard configuration.


    Bad idea, IMHO.

    Best Regards,
    Patrick


    --
    To UNSUBSCRIBE, email to debian-devel-REQUEST@lists.debian.org
    with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

  4. Re: [RFC] How should rsyslog handle .0 logfiles from sysklogd

    Michael Biebl wrote:
    [...]
    > Unfortunately sysklogd uses a custom log rotate mechanism,
    > which starts the log rotate cycle at .0
    > The default logrotate configuration starts the log rotate cyle at .1.


    > This leaves .0 files around when you switch from sysklogd to rsyslog [2]
    > which will never be rotated.

    [...]
    > 2.) Try to log rotate the .0 files for the default Debian log files in
    > postinst. I feel a bit uneasy about this approach, for several reasons:
    > - It adds fairly reasonable complexity to the maintainer scripts, if you
    > want to consider all corner cases.
    > E.g. if you switch from syslog-ng to rsyslog, it is very likely that you
    > have old .0 files lying around (from a sysklogd->syslog-ng switch), so
    > syslog.1 would be older than syslog.2 which would be very confusing.

    [...]

    I do not think it is that critical to work around the (same) bug in other
    syslog implementations.
    cu andreas
    --
    `What a good friend you are to him, Dr. Maturin. His other friends are
    so grateful to you.'
    `I sew his ears on from time to time, sure'


    --
    To UNSUBSCRIBE, email to debian-devel-REQUEST@lists.debian.org
    with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

  5. Re: [RFC] How should rsyslog handle .0 logfiles from sysklogd

    Patrick Schönfeld wrote:
    > 2008/9/19 Michael Biebl :

    [...]
    >> 3.) Delete the .0 files in postinst. Is this covered by the policy?


    > Not without a backup or asking the user first. You could ask the user
    > via debconf. I think this is a case, which would justify it.

    [...]

    I disagree that asking is a valid option. The right thing to do is to
    keep the latest n files, asking before deleting the second newest one
    does not make it the right thing.

    cu andreas


    --
    To UNSUBSCRIBE, email to debian-devel-REQUEST@lists.debian.org
    with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

  6. Re: [RFC] How should rsyslog handle .0 logfiles from sysklogd

    On Fri,19.Sep.08, 23:57:54, Michael Biebl wrote:

    > Afaics I have the following options.
    > 1.) Do nothing and simply document this fact in README.Debian, telling
    > the admin that he can safely delete this files if he no longer needs them.


    I would have rather suggested NEWS.Debian if apt-listchanges was higher
    priority. Anyway, this should also be documented in the release notes.

    After reading this I went on cleaning my /var/log/ and found some recent
    .0 files (I switched to rsyslog in July):

    $ ls -la /var/log/*.0
    -rw-r----- 1 root adm 51123 2008-09-19 22:09 /var/log/dmesg.0
    -rw-r--r-- 1 root root 46714 2008-09-13 06:25 /var/log/popularity-contest.0

    Regards,
    Andrei
    --
    If you can't explain it simply, you don't understand it well enough.
    (Albert Einstein)

    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.4.9 (GNU/Linux)

    iEYEARECAAYFAkjUvAUACgkQqJyztHCFm9kxIQCffJkFA+RIYx b755gGtbUELDmn
    yJsAn3eQ50dMDG1b3UQcrE/z7234qll4
    =Fgxl
    -----END PGP SIGNATURE-----


  7. Re: [RFC] How should rsyslog handle .0 logfiles from sysklogd

    Andrei Popescu wrote:
    > On Fri,19.Sep.08, 23:57:54, Michael Biebl wrote:
    >
    >> Afaics I have the following options.
    >> 1.) Do nothing and simply document this fact in README.Debian, telling
    >> the admin that he can safely delete this files if he no longer needs them.

    >
    > I would have rather suggested NEWS.Debian if apt-listchanges was higher
    > priority. Anyway, this should also be documented in the release notes.


    Agreed, mentioning this issue in the release notes would probably be a
    good idea in this case.


    > After reading this I went on cleaning my /var/log/ and found some recent
    > .0 files (I switched to rsyslog in July):


    I forgot to mention this in 2.). The .0 files will also be outdated if
    you have already switched to rsyslog (as user of testing or unstable),
    i.e. .1 will be newer than .0.
    What to do in this case? Rotating .0 imho would do more harm than good.

    Michael
    --
    Why is it that all of the instruments seeking intelligent life in the
    universe are pointed away from Earth?


    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.4.9 (GNU/Linux)
    Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

    iEYEARECAAYFAkjUvvUACgkQh7PER70FhVSdJgCffi5ejNGz/iTsyQEF7fJl45DP
    AeMAn39hFEdpqYhibJDCf/xBY2/5FQLz
    =tt5q
    -----END PGP SIGNATURE-----


  8. Re: [RFC] How should rsyslog handle .0 logfiles from sysklogd

    On 2008-09-20 11:14 +0200, Michael Biebl wrote:

    > Andrei Popescu wrote:
    >> I would have rather suggested NEWS.Debian if apt-listchanges was higher
    >> priority. Anyway, this should also be documented in the release notes.

    >
    > Agreed, mentioning this issue in the release notes would probably be a
    > good idea in this case.


    And they do not need to describe the issue in detail, just having a
    pointer to your (supposed) README.Debian is enough.

    >> After reading this I went on cleaning my /var/log/ and found some recent
    >> .0 files (I switched to rsyslog in July):

    >
    > I forgot to mention this in 2.). The .0 files will also be outdated if
    > you have already switched to rsyslog (as user of testing or unstable),
    > i.e. .1 will be newer than .0.
    > What to do in this case? Rotating .0 imho would do more harm than good.


    I think this pretty much rules 2.) out.

    Sven,
    who wishes that savelog and logrotate would agree on using .0 or .1
    files. Had to hunt down /var/log/*.0 and examine which files there
    actually belong to sysklogd.


    --
    To UNSUBSCRIBE, email to debian-devel-REQUEST@lists.debian.org
    with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

  9. Re: [RFC] How should rsyslog handle .0 logfiles from sysklogd

    On Sat, 2008-09-20 at 12:01:57 +0300, Andrei Popescu wrote:
    > On Fri,19.Sep.08, 23:57:54, Michael Biebl wrote:
    > > Afaics I have the following options.
    > > 1.) Do nothing and simply document this fact in README.Debian, telling
    > > the admin that he can safely delete this files if he no longer needs them.

    >
    > I would have rather suggested NEWS.Debian if apt-listchanges was higher
    > priority. Anyway, this should also be documented in the release notes.
    >
    > After reading this I went on cleaning my /var/log/ and found some recent
    > .0 files (I switched to rsyslog in July):
    >
    > $ ls -la /var/log/*.0
    > -rw-r----- 1 root adm 51123 2008-09-19 22:09 /var/log/dmesg.0
    > -rw-r--r-- 1 root root 46714 2008-09-13 06:25 /var/log/popularity-contest.0


    Those two are not obsolete, as they are being rotated by savelog,
    either by a cronjob or a boot script, the same applies for other .0
    log files. So this would have to be documented as well to avoid users
    removing valid files.

    regards,
    guillem


    --
    To UNSUBSCRIBE, email to debian-devel-REQUEST@lists.debian.org
    with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

  10. Re: [RFC] How should rsyslog handle .0 logfiles from sysklogd

    On Sat, Sep 20, 2008 at 01:20:06AM +0300, Faidon Liambotis wrote:
    > Michael Biebl wrote:
    > > 3.) Delete the .0 files in postinst. Is this covered by the policy?

    > I think that deleting logfiles without warning is totally unacceptable.


    Outside of purge at least.

    Gruesse,
    --
    Frank Lichtenheld
    www: http://www.djpig.de/


    --
    To UNSUBSCRIBE, email to debian-devel-REQUEST@lists.debian.org
    with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

  11. Re: [RFC] How should rsyslog handle .0 logfiles from sysklogd

    On Fri, 19 Sep 2008 23:57:54 +0200, Michael Biebl
    wrote:
    >2.) Try to log rotate the .0 files for the default Debian log files in
    >postinst. I feel a bit uneasy about this approach, for several reasons:
    >- It adds fairly reasonable complexity to the maintainer scripts, if you
    > want to consider all corner cases.
    >E.g. if you switch from syslog-ng to rsyslog, it is very likely that you
    >have old .0 files lying around (from a sysklogd->syslog-ng switch), so
    >syslog.1 would be older than syslog.2 which would be very confusing.


    Just check the timestamps of syslog.0 and rotate it to syslog.1 iff
    its timestamps are in between syslog and the former syslog.1. If they
    are not, throw a warning and leave.

    Greetings
    Marc

    --
    -------------------------------------- !! No courtesy copies, please !! -----
    Marc Haber | " Questions are the | Mailadresse im Header
    Mannheim, Germany | Beginning of Wisdom " | http://www.zugschlus.de/
    Nordisch by Nature | Lt. Worf, TNG "Rightful Heir" | Fon: *49 621 72739834


    --
    To UNSUBSCRIBE, email to debian-devel-REQUEST@lists.debian.org
    with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

  12. Re: [RFC] How should rsyslog handle .0 logfiles from sysklogd

    Marc Haber schrieb:
    > On Fri, 19 Sep 2008 23:57:54 +0200, Michael Biebl
    > wrote:
    >> 2.) Try to log rotate the .0 files for the default Debian log files in
    >> postinst. I feel a bit uneasy about this approach, for several reasons:
    >> - It adds fairly reasonable complexity to the maintainer scripts, if you
    >> want to consider all corner cases.
    >> E.g. if you switch from syslog-ng to rsyslog, it is very likely that you
    >> have old .0 files lying around (from a sysklogd->syslog-ng switch), so
    >> syslog.1 would be older than syslog.2 which would be very confusing.

    >
    > Just check the timestamps of syslog.0 and rotate it to syslog.1 iff
    > its timestamps are in between syslog and the former syslog.1. If they
    > are not, throw a warning and leave.


    Sounds reasonable. I'll implement something along those lines.

    Thanks for the feedback.


    Michael

    --
    Why is it that all of the instruments seeking intelligent life in the
    universe are pointed away from Earth?


    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.4.1 (MingW32)
    Comment: GnuPT 2.6.2.1 by EQUIPMENTE.DE
    Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

    iD8DBQFI1m6Th7PER70FhVQRAgKCAKC1ULUG57MJCA1rZiVDNJ q0a4LGUQCfZm5V
    /nPYbKCa8ic+aW/WVrvQX4s=
    =W+uq
    -----END PGP SIGNATURE-----


+ Reply to Thread