[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

newsyslog and intervals

Consider this scenario.

Log foo.log is set up in newsyslog.conf to be rotated every 12 hours.
It gets written to at 23:59. It rotates at midnight. At 9:59 there's
the only write operation of the day. At 12:00 the log gets rotated
because 12 hours have elapsed since foo.log.0's st_mtime. At 22:00
newsyslog checks the new foo.log.0's st_mtime, which is... 9:59. It
deduces that 12 hours have passed since the last rotation and goes
on to archive the current log. Wrong. It's only been 10 hours.

This bug doesn't manifest itself if you always have writes to a log
in the hour before it gets rotated. But if you don't, the next
rotation will happen earlier than expected.

Inspecting st_ctime works for me. Here's a trivial patch (sorry for
having it inline, for the email's poor formatting in general and
for the ad at the bottom, I am using a temporary setup):

--- newsyslog.c Sun Dec  5 15:46:44 2004
+++ newsyslog.c.new     Sun Dec  5 15:47:07 2004
@@ -931,7 +931,7 @@
                     COMPRESS_POSTFIX, &sb, stat) < 0)
                         return (-1);
-       return ((int)(timenow - sb.st_mtime + 1800) / 3600);
+       return ((int)(timenow - sb.st_ctime + 1800) / 3600);

  /* Skip Over Blanks */

Sign-up for Ads Free at Mail.com