status needsinfo
thanks

Hello Sebastien,

Sebastien Koechlin [2007-09-13 19:49 +0200]:
> Security systems usually send an alert everytime a configuration inode is
> changed to detect unwanted activity on system and to trace configuration
> changes. The /etc/postgresql/7.4/main/log symlink is recreated daily,
> probably by logrotate. This result in a daily alert and a daily growing
> configuration history.

I cannot reproduce this in unstable at least. When I do

  stat /etc/postgresql/7.4/main/log /var/log/postgresql/
  sudo logrotate -f -v /etc/logrotate.d/postgresql-common
  stat /etc/postgresql/7.4/main/log /var/log/postgresql/

then the only change to /etc/postgresql/7.4/main/log is the atime, and
/var/log/postgresql/ changed atime/mtime/ctime (quite understandably).
However, both the symlink and the directory keep their inode number.

Log rotation does not touch the symlink at all.

Can you please do above three commands and send me the output? (If you
do not use sudo to get root access, just execute all three commands as
root).

If those three commands did not change the inode, can you please try

  sudo /usr/sbin/pg_maintenance --full --force
  stat /etc/postgresql/7.4/main/log /var/log/postgresql/

Does that change the inode? (It does not for me).

Thanks,

Martin

-- 
Martin Pitt        http://www.piware.de
Ubuntu Developer   http://www.ubuntu.com
Debian Developer   http://www.debian.org

Attachment: signature.asc
Description: Digital signature

Reply via email to