tags 296096 pending
thanks
On Sun, 20 Feb 2005, CAiRO wrote:
> With the normal logcheck emails I constantly get the same reports about month
> old events that are long ago (and have already been reported several times).
> It seems it can't remember what it has reported already and what not.
could you please test the attached patch,
works on my system and is added to current logcheck cvs.
would be nice to get feedback if it works for you.
thanks
maks
Index: src/logcheck
===================================================================
RCS file: /cvsroot/logcheck/logcheck/src/logcheck,v
retrieving revision 1.105
diff -u -r1.105 logcheck
--- src/logcheck 9 Mar 2005 03:10:43 -0000 1.105
+++ src/logcheck 22 Mar 2005 22:55:55 -0000
@@ -398,16 +398,18 @@
offsetfile="$STATEDIR/offset$(echo $file|tr / .)"
if [ -s $offsetfile -a -r $offsetfile ]; then
if [[ $(wc -c < $file) -lt $(tail -n 1 $offsetfile) ]]; then
- if [ -e $file.0 ]; then
# assume the log is rotated by savelog(8)
+ # syslog-ng leaves old files here
+ if [ -e $file.0 -a $file.0 -nt $file.1.gz ]; then
debug "Running logtail on rotated: $file.0"
$LOGTAIL -f $file.0 -o $offsetfile $LOGTAIL_OPTS > \
$TMPDIR/logoutput/$(basename $file) 2>&1 \
|| error "Could not run logtail or save output"
rm -f $offsetfile \
|| error "Could not remove $offsetfile"
- elif [ -e $file.1 ]; then
# assume the log is rotated by logrotate(8)
+ # should also probably check if file is still fresh
+ elif [ -e $file.1 ]; then
debug "Running logtail on rotated: $file.1"
$LOGTAIL -f $file.1 -o $offsetfile $LOGTAIL_OPTS > \
$TMPDIR/logoutput/$(basename $file) 2>&1 \
