Log rotation (Argus)

[bbzz]

Hi all,

I'm trying to rotate net-mgmt/argus3 log file as such in /etc/newsyslog.conf

/var/log/argus/argus.out  644  100  200000  @T00 XB /var/run/argus.vlan667.0.pid

However, as soon as it is rotated, logging stops. Documentation doesn't specify specific SIG that needs to be added after pid file info.

Any help on this?

 

[bbzz]

Hi all,

Any help on this? Seems none of my colleagues can decipher this, and it sort of important

BR

 

[chrbr]

Since there is no answer up to now I suggest what I would do. The faq http://www.qosient.com/argus/faq.shtml says

14.2. Can I process/archive the Argus output file while Argus is running?

Argus allows for removing its output file, "on the fly". Argus will recover by recreating its output file, accordingly. This allows you to "pull" the data file away from an Argus daemon for processing, archiving, whatever.

The Argus package includes a sample program for managing Argus logs that takes advantage of this behavior. The very simple sh script is ./support/Archive/argusarchive. This program will simply rename a well known Argus output file, sort and compress its output, and then move to into a calender structured filesystem.

This is just a sample program, but it does do a pretty good job.

The idea is to have cron(8) execute this type of program on a time basis.

There is a sample crontab entry for this in the ./support/System directory, that calls argusarchive every hour.

Therefore I would try if net-mgt/argus survives if you delete the log file manually. If this does not work you might want to contact the maintainer and/or write a bug report. Additionally I should be worth to check the script mentioned in the faq.

 

[tOsYZYny]

I have noticed that argus does successfully recreate the logfile for me once deleted. My configuration was originally incorrect, I had used C instead of B and that caused the format to be corrupt which would cause problems when trying to process the split files later.