Bug 259281 - logrotates default config rotates wtmp irrationally often
logrotates default config rotates wtmp irrationally often
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: logrotate (Show other bugs)
5.0
All All
medium Severity low
: ---
: ---
Assigned To: Tomas Smetana
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2007-08-28 04:28 EDT by ilja lunev
Modified: 2013-04-12 15:19 EDT (History)
1 user (show)

See Also:
Fixed In Version: RHBA-2007-1002
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2007-11-15 09:07:47 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description ilja lunev 2007-08-28 04:28:35 EDT
Description of problem:
The default config for logrotate contains the following specification for wtmp

/var/log/wtmp {
    monthly
    create 0664 root utmp
    rotate 1

wtmp is the source to "last" which gives valuable login information.
Many systems show only few entries thus it seems more reasonable to me to rotate
wtmp depending on its size than on a fixed time schedule.
A fixed time schedule can too easily loose valuable history information
especially in an enterprise environment.
I suggest to change the default from "monthly" to "size=1M" which I rate a good
balance between log size and history information.
Comment 1 Tomas Smetana 2007-08-28 04:46:52 EDT
This could lead to an endless discussion...  Personally I think it's better to
know that I always have two months history login records than a particular size
of a log file (that also may not fit everyone).  Let the PM decide.
Comment 2 ilja lunev 2007-08-29 02:48:44 EDT
If the PM decides to leave it like it is that's OK to me.
I can always make my own settings of course.
My statement is just derived from real world scenarios where I support app. 200
Linux and HPUX hosts and most of them have only about 30 entries in wtmp. Thus
there is valuable history information lost when the log holds only 2 months of
data. 
With RH5 there is the option minsize which only rotates at a given time
specification when the log is larger than minsize.
So it may be a good compromise to specify
 /var/log/wtmp {
    monthly
    minsize 1M
    create 0664 root utmp
    rotate 1
}
  
Comment 3 Tomas Smetana 2007-08-29 03:06:55 EDT
Yes, minsize looks to be a good solution.
Comment 10 errata-xmlrpc 2007-11-15 09:07:47 EST
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2007-1002.html

Note You need to log in before you can comment on or make changes to this bug.