Red Hat Bugzilla – Bug 116599
lowatch and logrotate not synchronized
Last modified: 2007-11-30 17:06:54 EST
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6)
Description of problem:
Every day logwatch sends me the system reports. Very good.
I noticed that on Monday Morning I get system reports on Sunday's
activity, but some information I would expect to see is missing.
After a little digging I realzied the logrotate and logwatch run at
different times, so whereas I am expecting each days activity to be
sent to me the following morning, on Sunday the weekly logrotate jobs
are chopping off the logs that logwatch looks at on Monday morning.
I don't know what the most elegant way to address this would be, but
it should be addressed so that standard install systems work as expected.
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1. Install logwatch and logrotate
2. Have an scp process that runs every hour
3. expect a logwatch e-mail report every day that shows 24 ssh logins
4. On Monday morning, the Sunday report will be short a few logins
because before the logwatch process ran, logrotate moved the
/var/log/secure file (maybe 2 or 3am?) so instead of seeing 24 logins
you will only see 20 or 21.
This does not meet the requirements for RHEL 2.1, which is currently in
maintenance mode; as such, this won't be fixed for 2.1.