Red Hat Bugzilla – Bug 458580
logwatch + logrotate(dateext) wrong output
Last modified: 2008-12-12 05:05:38 EST
Description of problem:
Using logwatch + new logrotate
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1. Remove old logfiles, if still present
rm *.1 *.2 *.3 *.4 *.5 */*.1 */*.2 */*.3 */*.4 */*.5
# add -f, if you are sure
2. verify, that dateext is set:
grep ^dateext /etc/logrotate.conf
ls -la /var/log/*-*
3. logwatch --range Yesterday --service postfix
Nothing (empty output). May be sometimes output is incomplete.
I think there is a problem with logwatch configuration. For example this file contains:
Archive = messages.*
Archive = archiv/messages.*
But does not contain:
Archive = messages-*
Logrotate in F8+ has an option "dateext" which saves old logs into filenames like: /var/log/messages-20080810
They are not parsed by current logwatch. Adding messages-* fix this probem.
This heve to be done for all configuration files. May be in upstream too.
logwatch runs before logrotate each morning, so the automatically-generated logwatch e-mails will only be incorrect on Monday morning - Sunday's log entries will be split across two files due to rotation on Sunday morning.
Since dateext is a parameter, the logwatch config files should be updated to cope both dates *and* numbers in the archived logs.
This problem should be fixed by version 7.3.6-28.fc10. Could you please test it?
I don't see fix in sources and config files in this version.
In maillog.conf there are still only these files:
Archive = maillog.*
Archive = syslog.*
Archive = archiv/maillog.*
Archive = mail.log.*.gz
Still same problem, I was tryed to rotate my logs manually and after this rotation there are no output of maillog.
I think this have to be done for other logfiles/*.conf files.
Please, update "needinfo" flag, because I am not "ondrejj" but "firstname.lastname@example.org" and I have no access to this flag.
The change is in fc10 branch for now, but I will put it to fc9 and attach a link here.
The package n-v-r is logwatch-7.3.6-24.fc9. Is this version ok?
This looks OK, but does not work on my Fedora 9 machine. But I think problem is now on my side (yesterday's mail logs are missing in my logfile). I can't test this before it will be at least in fedora-testing repository for F8.
Please, request to add to fedora8-testing and I will make more tests.
logwatch-7.3.6-logrotate.patch looks to be OK.
logwatch-7.3.6-17.fc8 has been submitted as an update for Fedora 8.
> The package n-v-r is logwatch-7.3.6-24.fc9. Is this version ok?
I've downloaded it from Koji and installed it; I'll know if it's fixed the problem on Monday morning!
logwatch-7.3.6-17.fc8 has been pushed to the Fedora 8 testing repository. If problems still persist, please make note of it in this bug report.
If you want to test the update, you can install it with
su -c 'yum --enablerepo=updates-testing update logwatch'. You can provide feedback for this update here: http://admin.fedoraproject.org/updates/F8/FEDORA-2008-8232
Works well for me on F8. Please put this to stable.
logwatch-7.3.6-17.fc8 has been pushed to the Fedora 8 stable repository. If problems still persist, please make note of it in this bug report.
I'm testing logwatch-7.3.6-25.fc9.noarch due to bug 462174, and this version correctly deals with log entries in the archived maillog. Thanks!