Bug 116599

Summary: lowatch and logrotate not synchronized
Product: Red Hat Enterprise Linux 2.1 Reporter: Ben Russo <ben.russo>
Component: logwatchAssignee: Ivana Varekova <varekova>
Status: CLOSED WONTFIX QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: 2.1   
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2005-08-29 10:31:02 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Description Ben Russo 2004-02-23 17:26:32 UTC
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6)
Gecko/20040113

Description of problem:
Every day logwatch sends me the system reports.  Very good.
I noticed that on Monday Morning I get system reports on Sunday's
activity, but some information I would expect to see is missing.

After a little digging I realzied the logrotate and logwatch run at
different times, so whereas I am expecting each days activity to be
sent to me the following morning, on Sunday the weekly logrotate jobs
are chopping off the logs that logwatch looks at on Monday morning.

I don't know what the most elegant way to address this would be, but
it should be addressed so that standard install systems work as expected.

Version-Release number of selected component (if applicable):
logrotate-3.5.9-1 logwatch-2.6-1

How reproducible:
Always

Steps to Reproduce:
1. Install logwatch and logrotate
2.  Have an scp process that runs every hour
3.  expect a logwatch e-mail report every day that shows 24 ssh logins
4.  On Monday morning, the Sunday report will be short a few logins
because before the logwatch process ran, logrotate moved the
/var/log/secure file (maybe 2 or 3am?)  so instead of seeing 24 logins
you will only see 20 or 21.
    

Additional info:

Comment 1 Ivana Varekova 2005-08-29 10:31:02 UTC
This does not meet the requirements for RHEL 2.1, which is currently in
maintenance mode; as such, this won't be fixed for 2.1.