Chris W. Parker wrote: > Hey there y'all. > > Let's see... I have a Sonicwall firewall that is sending it's data to > my linux box via local0. > > Here is the pertinent line in /etc/syslog.conf: > > local0.* /var/log/sonicwall/log > > Here is /etc/logrotate.conf (I removed all unnecessary lines): > > weekly > rotate 8 > create > include /etc/logrotate.d > > /var/log/wtmp { > monthly > create 0664 root utmp > rotate 1 > } > > /var/log/sonicwall/log { > daily > rotate 7 > create > compress > } > > For about one day the file /var/log/sonicwall/log increased in size > (as it should) as the sonicwall entries were inserted into it. After > that day when the logrotate script ran it created a log.1.gz file. > This of course is because of the "compress" option. BUT!! After that, > the /var/log/sonicwall/log file stopped increasing in size because > it wasn't having any entries put into it.
May I suggest that you place your sonicwall/log entry in the correct file or add a postrotate directive to what you have above. For reference: try /etc/logrotate.d/syslog -or- create your own logrotate file. Notice that most of the scripts in logrotate.d perform a postrotate by bouncing syslogd or the application writing to the logfile. Which will then allow syslogd or the application to write to the logfiles files after they have been moved and recreated by logrotate. Steve Cowles -- redhat-list mailing list unsubscribe mailto:[EMAIL PROTECTED] https://www.redhat.com/mailman/listinfo/redhat-list