Hi Elf,
> It is abnormal to have the syslogd restart daily; unless your logs rotate
> on a daily basis.
[Groan] For each opinion or suggestion you find a contradicting information
on this list.
I'm sorry, but what you state as fact is either plain wrong or based on
assumptions which are not correct.
Logfiles rotate on the following basis (which will force syslog to be stopped
and started):
a) Upon boot
b) By /etc/cron.daily
c) As defined in /etc/logrotate.conf
Point (c) is the most interesting. By default on a RaQ3 there is a generic
size limit for logfiles, which is set to 1Meg. So if there are logs which are
larger than 1Meg, then logrotate will shutdown syslog, zip the log up and
will then restart syslog.
See: "man syslog" for details. It is obvious that you haven't. ;o)
I have several very active opt-in mailing lists on my RaQ3 with hundrets of
outgoing emails per hour. Imagine what this does to my /var/log/maillog and
how often syslog is restarted on my machine per day. I haven't counted it,
but it's more than three times for sure.
Mit freundlichen Gr��en / Best regards
Michael Stauber
_______________________________________________
cobalt-security mailing list
[EMAIL PROTECTED]
http://list.cobalt.com/mailman/listinfo/cobalt-security
