Riddle me on this one

[Lennart Sorensen]

On Sat, Jan 21, 2012 at 11:30:29PM -0500, D. Hugh Redelmeier wrote:
> Of course you are right: log rotation doesn't generally reduce space 
> requirements NOW.  It might in the case where it deletes the oldest logs 
> and those logs are large.  Compression would help, but again, not NOW
> (during compression, space is needed for both the original and the
> compressed file).
> 
> What I was really thinking (but didn't say) is that any log rotation
> system must solve the problem of getting the log file closed for the
> rotation to take effect.
> 
> 
> You really have to go back to how programs log things.  I think
> that they are all creatively different.
> 
> If they use syslog(3), the actual file writing will be done by
> syslogd(8).  So it is the only program that needs to be kicked to
> close the log file (& likely reopen a different file with the same
> name).  According to the manpages on my system, a SIGHUP to syslogd
> should do the trick.
> 
> So it seems to me (which means: I have made this all up), log rotation
> would be: rename all log file, possibly deleting oldest ones and
> compressing less old ones, and signal syslogd with a SIGHUP to have it
> close and reopen the log files.
> 
> This may be optimistic: my suspicion is that logging daemons is where
> there has been some creativity in the distro worlds.  Furthermore, I
> think that many programs think that they know how to log better than
> syslog(8) provides.
> 
> The logrotate(8) example /etc/logrotate.conf certainly shows that
> several things (eg.  apache) do their own logging.  How you discover
> this for each application of interest seems like a mess.
> 
> 
> Sidenote: many programmers don't know how to correctly handle signals
> in C.  In particular, the only safe thing to do in a signal handler is
> to set a flag and return.  The program must then check that flag
> frequently and act accordingly when the flag is found to be set.  For
> example, years ago, I could not convince the main author of PINE that
> doing too much in a signal handler was why PINE was breaking on
> Solaris.  He blamed Solaris.

That's when I stopped using pine.  That's a long time ago.

-- 
Len Sorensen
--
The Toronto Linux Users Group.      Meetings: http://gtalug.org/
TLUG requests: Linux topics, No HTML, wrap text below 80 columns
How to UNSUBSCRIBE: http://gtalug.org/wiki/Mailing_lists