Hi there, On Mon, 14 Dec 2009 Jason Frisvold wrote:
> G.W. Haywood wrote: > > > What version of logrotate are you using? > > Version 3.7.4, apparently. Should be OK. > As for clamd, the config (minus comments, whitespace, etc) is as follows : > > LogFile /var/log/clamav/clamd.log > LogFileMaxSize 0 > LogTime yes > LogSyslog yes > [snip] > > So yes, I have clam writing directly to a log file, which I then > want to rotate on a regular basis. You appear to have asked clamd to write both directly to a log file, and via syslog. I don't think that's wise. Amongst other things, timestamps will not be required for logging via syslog but they will normally be required for writing directly to a file. If syslog is writing your logs, you need to send SIGHUP to syslog (not to clamd) when you rotate the logs. Incidentally you also use TCP sockets and not Unix sockets. That's not recommended on security grounds, but I don't think it matters for this discussion. > So a SIGHUP should cause the logfile to be re-opened. The man page doesn't seem to mention signals although as you say, they are mentioned elsewhere in the documentation. This might need to be raised as a bug. > If i understand correctly, if the logfile is moved, the file handles > follow. Yes, a process will continue writing to a renamed file until it closes the file descriptor and reopens the file, when it will start writing to the new file. > However, a sighup should cause the new logfile to be used, assuming > it has the same name/permissions as the original. Correct, assuming that the daemon is catching the signal. Sorry, I don't have time to check right now - I'm going to hit the road for a few days right now. > BTW.. 73? What's the significance? Google for Morse code. :) -- 73, Ged. _______________________________________________ Help us build a comprehensive ClamAV guide: visit http://wiki.clamav.net http://www.clamav.net/support/ml
