[sisyphus] logrotate не ротейтит логи от snort

[Alexandr Isaev]

Имеем стандартные логи от snort:

#ls -l /var/log/snort
-rw------- 1 snort snort 10778160 Дек 17 13:30 alert
-rw------- 1 snort snort      651 Дек 13 11:05 snort.log.1197507874
-rw------- 1 snort snort  5919270 Дек 17 13:30 snort.log.1197509314
-rw------- 1 snort snort      205 Дек 13 12:09 snort.log.1197511518
-rw------- 1 snort snort     3719 Дек 13 15:48 snort.log.1197524772
-rw------- 1 snort snort     4165 Дек 13 15:50 snort.log.1197524897
-rw------- 1 snort snort      710 Дек 13 15:53 snort.log.1197525128
-rw------- 1 snort snort      207 Дек 13 15:54 snort.log.1197525245
-rw------- 1 snort snort  5733048 Дек 17 13:02 snort.log.1197527259
-rw------- 1 snort snort    17992 Дек 17 13:30 snort.log.1197860539

и стандартный логротейт файл из пакета snort:

# [root на avi logrotate.d]# cat /etc/logrotate.d/snort
/var/log/snort/* {
     daily
     rotate 7
     missingok
     compress
     postrotate
         /sbin/service snortd condreload 2>/dev/null || true
     endscript
}

/var/log/snort/*/* {
     daily
     rotate 7
     missingok
     compress
     postrotate
         /sbin/service snortd condreload 2>/dev/null || true
     endscript
}

а теперь запускаем logrotate на эту конструкцию:

# logrotate -d /etc/logrotate.d/snort
reading config file /etc/logrotate.d/snort
Ignoring /var/log/snort/snort.log.1197507874, because of ".1197507874" 
ending
Ignoring /var/log/snort/snort.log.1197509314, because of ".1197509314" 
ending
Ignoring /var/log/snort/snort.log.1197511518, because of ".1197511518" 
ending
Ignoring /var/log/snort/snort.log.1197524772, because of ".1197524772" 
ending
Ignoring /var/log/snort/snort.log.1197524897, because of ".1197524897" 
ending
Ignoring /var/log/snort/snort.log.1197525128, because of ".1197525128" 
ending
Ignoring /var/log/snort/snort.log.1197525245, because of ".1197525245" 
ending
Ignoring /var/log/snort/snort.log.1197527259, because of ".1197527259" 
ending
Ignoring /var/log/snort/snort.log.1197860539, because of ".1197860539" 
ending
End of reading config info for /var/log/snort/*
error: error accessing /var/log/snort/*: No such file or directory
error: /etc/logrotate.d/snort:11 glob failed for /var/log/snort/*/*

/var/log/snort/alert проигнорирован, snort.log.* в общем-то понятно 
почему проигнорированы, но они ротейтятся самим snort-ом поэтому ничего 
страшного, а вот с alert надо что-то делать.