[sisyphus] logrotate не ротейтит логи от snort
Dmitry V. Levin
=?iso-8859-1?q?ldv_=CE=C1_altlinux=2Eorg?=
Пн Дек 17 11:38:13 MSK 2007
On Mon, Dec 17, 2007 at 01:59:57PM +1000, Alexandr Isaev wrote:
> Имеем стандартные логи от snort:
>
> #ls -l /var/log/snort
> -rw------- 1 snort snort 10778160 Дек 17 13:30 alert
> -rw------- 1 snort snort 651 Дек 13 11:05 snort.log.1197507874
> -rw------- 1 snort snort 5919270 Дек 17 13:30 snort.log.1197509314
> -rw------- 1 snort snort 205 Дек 13 12:09 snort.log.1197511518
> -rw------- 1 snort snort 3719 Дек 13 15:48 snort.log.1197524772
> -rw------- 1 snort snort 4165 Дек 13 15:50 snort.log.1197524897
> -rw------- 1 snort snort 710 Дек 13 15:53 snort.log.1197525128
> -rw------- 1 snort snort 207 Дек 13 15:54 snort.log.1197525245
> -rw------- 1 snort snort 5733048 Дек 17 13:02 snort.log.1197527259
> -rw------- 1 snort snort 17992 Дек 17 13:30 snort.log.1197860539
>
> и стандартный логротейт файл из пакета snort:
>
> # [root на avi logrotate.d]# cat /etc/logrotate.d/snort
> /var/log/snort/* {
> daily
> rotate 7
> missingok
> compress
> postrotate
> /sbin/service snortd condreload 2>/dev/null || true
> endscript
> }
>
> /var/log/snort/*/* {
> daily
> rotate 7
> missingok
> compress
> postrotate
> /sbin/service snortd condreload 2>/dev/null || true
> endscript
> }
>
> а теперь запускаем logrotate на эту конструкцию:
>
> # logrotate -d /etc/logrotate.d/snort
> reading config file /etc/logrotate.d/snort
> Ignoring /var/log/snort/snort.log.1197507874, because of ".1197507874"
> ending
> Ignoring /var/log/snort/snort.log.1197509314, because of ".1197509314"
> ending
> Ignoring /var/log/snort/snort.log.1197511518, because of ".1197511518"
> ending
> Ignoring /var/log/snort/snort.log.1197524772, because of ".1197524772"
> ending
> Ignoring /var/log/snort/snort.log.1197524897, because of ".1197524897"
> ending
> Ignoring /var/log/snort/snort.log.1197525128, because of ".1197525128"
> ending
> Ignoring /var/log/snort/snort.log.1197525245, because of ".1197525245"
> ending
> Ignoring /var/log/snort/snort.log.1197527259, because of ".1197527259"
> ending
> Ignoring /var/log/snort/snort.log.1197860539, because of ".1197860539"
> ending
> End of reading config info for /var/log/snort/*
> error: error accessing /var/log/snort/*: No such file or directory
> error: /etc/logrotate.d/snort:11 glob failed for /var/log/snort/*/*
А зачем вам понадобился /var/log/snort/*/*?
--
ldv
----------- следующая часть -----------
Было удалено вложение не в текстовом формате...
Имя : =?iso-8859-1?q?=CF=D4=D3=D5=D4=D3=D4=D7=D5=C5=D4?=
Тип : application/pgp-signature
Размер : 189 байтов
Описание: =?iso-8859-1?q?=CF=D4=D3=D5=D4=D3=D4=D7=D5=C5=D4?=
Url : <http://lists.altlinux.org/pipermail/sisyphus/attachments/20071217/ca69273a/attachment-0002.bin>
Подробная информация о списке рассылки Sisyphus