[gentoo-user] strange cron messages...

[gentoo-user] strange cron messages...

[Jarry]

Hi, I'm getting strange mails from vixie-cron-4.1-r10:
------------------
SUBJECT: Cron <root@obelix> test -x /usr/sbin/run-crons && 
/usr/sbin/run-crons

error: kernel:9 unknown option 'compytruncate' -- ignoring line
error: kernel:12 unknown option 'endscript' -- ignoring line
------------------

What does it mean???

Jarry

-- 
_______________________________________________________________
This mailbox accepts e-mails only from selected mailing-lists!
Everything else is considered to be spam and therefore deleted.

Re: [gentoo-user] strange cron messages...

[Alex Schuster]

Jarry writes:

> Hi, I'm getting strange mails from vixie-cron-4.1-r10:
> ------------------
> SUBJECT: Cron <root@obelix> test -x /usr/sbin/run-crons &&
> /usr/sbin/run-crons
> 
> error: kernel:9 unknown option 'compytruncate' -- ignoring line
> error: kernel:12 unknown option 'endscript' -- ignoring line
> ------------------
> 
> What does it mean???

I assume you are using logrotate, and have the /etc/logrotate.d/kernel 
file? I guess the 'compytruncate' is misspelled and should be 
'copytruncate'. And 'endscript' is used after using 'prerotate' or 
'postrotate', which you probably do not have.

Something like that, I never used logrotate by myself. See the man page 
for more information.

	Wonko

Re: [gentoo-user] strange cron messages...

[Mick]

[-- Attachment #1: Type: Text/Plain, Size: 889 bytes --]

On Saturday 14 November 2009 16:53:24 Alex Schuster wrote:
> Jarry writes:
> > Hi, I'm getting strange mails from vixie-cron-4.1-r10:
> > ------------------
> > SUBJECT: Cron <root@obelix> test -x /usr/sbin/run-crons &&
> > /usr/sbin/run-crons
> >
> > error: kernel:9 unknown option 'compytruncate' -- ignoring line
> > error: kernel:12 unknown option 'endscript' -- ignoring line
> > ------------------
> >
> > What does it mean???
> 
> I assume you are using logrotate, and have the /etc/logrotate.d/kernel
> file? I guess the 'compytruncate' is misspelled and should be
> 'copytruncate'. And 'endscript' is used after using 'prerotate' or
> 'postrotate', which you probably do not have.
> 
> Something like that, I never used logrotate by myself. See the man page
> for more information.

Hmm ... how do you keep your log files under control?
-- 
Regards,
Mick

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

Re: [gentoo-user] strange cron messages...

[Eray Aslan]

On 15.11.2009 13:45, Mick wrote:
> On Saturday 14 November 2009 16:53:24 Alex Schuster wrote:
>> I assume you are using logrotate, and have the /etc/logrotate.d/kernel
>> file? I guess the 'compytruncate' is misspelled and should be
>> 'copytruncate'. And 'endscript' is used after using 'prerotate' or
>> 'postrotate', which you probably do not have.
>>
>> Something like that, I never used logrotate by myself. See the man page
>> for more information.
> 
> Hmm ... how do you keep your log files under control?

Use time-based file names.  For syslog-ng something like:

    destination mail {
	    file("/var/log/mail/$YEAR/$MONTH/$DAY/$HOUR"
	    template("$ISODATE $HOST $MSG\n") template_escape(no)
	    owner("root") group("log") perm(0640)
	    dir_owner("root") dir_group("log")
	    dir_perm(02750) create_dirs(yes));
	};
    destination msgs {
	    file("/var/log/msgs/$YEAR/$MONTH/$DAY/$HOUR"
	    template("$ISODATE $HOST $MSG\n") template_escape(no)
	    owner("root") group("log") perm(0640)
	    dir_owner("root") dir_group("log")
	    dir_perm(02750) create_dirs(yes));
	};

    source local { unix-dgram("/dev/log"); pipe("/proc/kmsg");
internal(); };
    filter mail { facility(mail); };
    filter notmail { not facility(mail); };
    log { source(local); filter(mail); destination(mail); };
    log { source(local); filter(notmail); destination(msgs); };


Important points:
    - "unix-dgram" is good
    - Use template() to determine the format
    - No need to logrotate with time based filenames.  Hence, no need to
"kill -HUP" the syslog daemon.  No missed logs.
    - Easier to get the log files to a central server with time based
filenames.
    - "log" group is for transfering the log files to a central server

-- 
Eray

Re: [gentoo-user] strange cron messages...

[Graham Murray]

Eray Aslan <eray.aslan@caf.com.tr> writes:

>     - No need to logrotate with time based filenames.  Hence, no need to
> "kill -HUP" the syslog daemon.  No missed logs.

But you still need some system (eg tmpwatch) to delete old log files
otherwise the disk will (eventually) fill with log files. Logrotate
automatically handles the number of/how long to keep logs.

Re: [gentoo-user] strange cron messages...

[Eray Aslan]

On 16.11.2009 10:08, Graham Murray wrote:
> Eray Aslan <eray.aslan@caf.com.tr> writes:
> 
>>     - No need to logrotate with time based filenames.  Hence, no need to
>> "kill -HUP" the syslog daemon.  No missed logs.
> 
> But you still need some system (eg tmpwatch) to delete old log files
> otherwise the disk will (eventually) fill with log files. Logrotate
> automatically handles the number of/how long to keep logs.

If you want to be complete, you compress old log files, transfer them to
the central log server and delete them when they are old enough.  These
are done with a few trivial scripts run via cron.

If that seems like too much work for questionable benefit, by all means
use logrotate.

-- 
Eray

Re: [gentoo-user] strange cron messages...

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 678 bytes --]

On Mon, 16 Nov 2009 09:05:18 +0200, Eray Aslan wrote:

>     - No need to logrotate with time based filenames.  Hence, no need to
> "kill -HUP" the syslog daemon.  No missed logs.

Then how do you get the server to use the new logfile names each
day/week? You only need to send a SIGHUP to the server using that log
facility, so syslog would not be affected in your example.

>     - Easier to get the log files to a central server with time based
> filenames.

Logrotate can use datestamps in the rotated logfile names. You can use
the postrotate facility to copy them automatically.


-- 
Neil Bothwick

Uhura: Captain, you're being flamed on channel one.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

Re: [gentoo-user] strange cron messages...

[Eray Aslan]

On 16.11.2009 14:46, Neil Bothwick wrote:
> On Mon, 16 Nov 2009 09:05:18 +0200, Eray Aslan wrote:
> 
>>     - No need to logrotate with time based filenames.  Hence, no need to
>> "kill -HUP" the syslog daemon.  No missed logs.
> 
> Then how do you get the server to use the new logfile names each
> day/week?

It creates and uses a new file each hour/day/etc.  Perhaps, you missed
the file(...) directive?  Reposting for your reference:

    destination mail {
	    file("/var/log/mail/$YEAR/$MONTH/$DAY/$HOUR"
	    [...]

> You only need to send a SIGHUP to the server using that log
> facility, so syslog would not be affected in your example.

I can't parse this.  The point is avoiding SIGHUP so that we do not miss
any log messages.

OP asked how one manages log files without logrotate and the answer is
with time based file names.  It has the additional benefit of avoiding
SIGHUP.

-- 
Eray

Re: [gentoo-user] strange cron messages...

[Alan McKinnon]

On Monday 16 November 2009 17:55:51 Eray Aslan wrote:
> On 16.11.2009 14:46, Neil Bothwick wrote:
> > On Mon, 16 Nov 2009 09:05:18 +0200, Eray Aslan wrote:
> >>     - No need to logrotate with time based filenames.  Hence, no need to
> >> "kill -HUP" the syslog daemon.  No missed logs.
> >
> > Then how do you get the server to use the new logfile names each
> > day/week?
> 
> It creates and uses a new file each hour/day/etc.  Perhaps, you missed
> the file(...) directive?  Reposting for your reference:
> 
>     destination mail {
> 	    file("/var/log/mail/$YEAR/$MONTH/$DAY/$HOUR"
> 	    [...]
> 
> > You only need to send a SIGHUP to the server using that log
> > facility, so syslog would not be affected in your example.
> 
> I can't parse this.  The point is avoiding SIGHUP so that we do not miss
> any log messages.
> 
> OP asked how one manages log files without logrotate and the answer is
> with time based file names.  It has the additional benefit of avoiding
> SIGHUP.
> 

I have three machines that randomly kill syslog or syslog-ng as appropriate 
whenever they feel like it on daily rotates. There's no warning, no evidence, 
they just ... die. 5 minutes later nagios goes ballistic and I have work to 
do. That all three are SuSE machines is probably highly relevant.

So, anything that syslog-ng can do itself without needing external 
intervention is a very good thing. I can then compress and move the closed 
files around later at my leisure in complete safety.

-- 
alan dot mckinnon at gmail dot com

Re: [gentoo-user] strange cron messages...

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 1368 bytes --]

On Mon, 16 Nov 2009 17:55:51 +0200, Eray Aslan wrote:

> On 16.11.2009 14:46, Neil Bothwick wrote:
> > On Mon, 16 Nov 2009 09:05:18 +0200, Eray Aslan wrote:
> > 
> >>     - No need to logrotate with time based filenames.  Hence, no
> >> need to "kill -HUP" the syslog daemon.  No missed logs.
> > 
> > Then how do you get the server to use the new logfile names each
> > day/week?
> 
> It creates and uses a new file each hour/day/etc.  Perhaps, you missed
> the file(...) directive?

I didn't miss it. My question was how to you get the process to USE the
new file. Unless you SIGHUP the process, it will continue using the
config in pace when it started.

> > You only need to send a SIGHUP to the server using that log
> > facility, so syslog would not be affected in your example.
> 
> I can't parse this.  The point is avoiding SIGHUP so that we do not miss
> any log messages.

You wouldn't miss a log messsage by sending a SIGHUP to your mail server,
the logger woulsd keep running.

> OP asked how one manages log files without logrotate and the answer is
> with time based file names.  It has the additional benefit of avoiding
> SIGHUP.

I understood both the question and answer, but it seems like you are
avoiding logrotate by re-implementing it in your scripts.


-- 
Neil Bothwick

An example of hard water is ice.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

Re: [gentoo-user] strange cron messages...

[Eray Aslan]

On 17.11.2009 10:59, Neil Bothwick wrote:
>>> Then how do you get the server to use the new logfile names each
>>> day/week?
>> It creates and uses a new file each hour/day/etc.  Perhaps, you missed
>> the file(...) directive?
> 
> I didn't miss it. My question was how to you get the process to USE the
> new file. Unless you SIGHUP the process, it will continue using the
> config in pace when it started.

Last sentence is correct.  What you are missing is that the config says
to start a new file each day/hour/etc.  syslog-ng does not evaluate the
file() expression once at startup and then treat it as a constant.

# ls /var/log/HOSTS/north/|tail -n5
north.2009.07.log.gz
north.2009.08.log.gz
north.2009.09.log.gz
north.2009.10.log.gz
north.2009.11.log

There was no SIGHUP involved.

>>> You only need to send a SIGHUP to the server using that log
>>> facility, so syslog would not be affected in your example.
>> I can't parse this.  The point is avoiding SIGHUP so that we do not miss
>> any log messages.
> 
> You wouldn't miss a log messsage by sending a SIGHUP to your mail server,
> the logger woulsd keep running.

When syslog-ng cannot process messages for whatever reason, it will
buffer them.  When the buffer is full, it will drop the messages.  There
is no need to add to the load and increase message loss probability with
SIGHUP (think of a central log server).

-- 
Eray

Re: [gentoo-user] strange cron messages...

[Alan McKinnon]

On Tuesday 17 November 2009 14:08:00 Eray Aslan wrote:
> > You wouldn't miss a log messsage by sending a SIGHUP to your mail server,
> > the logger woulsd keep running.
> 
> When syslog-ng cannot process messages for whatever reason, it will
> buffer them.  When the buffer is full, it will drop the messages.  There
> is no need to add to the load and increase message loss probability with
> SIGHUP (think of a central log server).
> 

s/syslog-ng/syslog-ng Premium Version (paid for)/

-- 
alan dot mckinnon at gmail dot com

Re: [gentoo-user] strange cron messages...

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 1035 bytes --]

On Tue, 17 Nov 2009 14:08:00 +0200, Eray Aslan wrote:

> > I didn't miss it. My question was how to you get the process to USE
> > the new file. Unless you SIGHUP the process, it will continue using
> > the config in pace when it started.
> 
> Last sentence is correct.  What you are missing is that the config says
> to start a new file each day/hour/etc.  syslog-ng does not evaluate the
> file() expression once at startup and then treat it as a constant.

Ah, it makes sense now.

> > You wouldn't miss a log messsage by sending a SIGHUP to your mail
> > server, the logger would keep running.
> 
> When syslog-ng cannot process messages for whatever reason, it will
> buffer them.  When the buffer is full, it will drop the messages.  There
> is no need to add to the load and increase message loss probability with
> SIGHUP (think of a central log server).

How does sending a SIGHUP to smtpd increase the load on the syslog server?


-- 
Neil Bothwick

Warp 5.. engage. No, no, Mr. Data, more clutch!

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

Re: [gentoo-user] strange cron messages...

[Eray Aslan]

On 17.11.2009 17:08, Neil Bothwick wrote:
>>> You wouldn't miss a log messsage by sending a SIGHUP to your mail
>>> server, the logger would keep running.
>> When syslog-ng cannot process messages for whatever reason, it will
>> buffer them.  When the buffer is full, it will drop the messages.  There
>> is no need to add to the load and increase message loss probability with
>> SIGHUP (think of a central log server).
> 
> How does sending a SIGHUP to smtpd increase the load on the syslog server?

Ugh, smtpd?  Where did that come from?  There was no mention of smtpd in
the thread.

Hectic day at work? :)

-- 
Eray

Re: [gentoo-user] strange cron messages...

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 778 bytes --]

On Tue, 17 Nov 2009 17:25:02 +0200, Eray Aslan wrote:

> > How does sending a SIGHUP to smtpd increase the load on the syslog
> > server?  
> 
> Ugh, smtpd?  Where did that come from?  There was no mention of smtpd in
> the thread.

    destination mail {
	    file("/var/log/mail/$YEAR/$MONTH/$DAY/$HOUR"
	    template("$ISODATE $HOST $MSG\n") template_escape(no)
	    owner("root") group("log") perm(0640)
	    dir_owner("root") dir_group("log")
	    dir_perm(02750) create_dirs(yes));
	};

I assumed that a destination called mail was for a mail server, not
general syslog messages :)

> Hectic day at work? :)

I' m not working today, decorating is even more stressful :(


-- 
Neil Bothwick

And if you say "No", I shall be forced to shoot you.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 198 bytes --]

Re: [gentoo-user] strange cron messages...

[Alan McKinnon]

On Tuesday 17 November 2009 18:08:21 Neil Bothwick wrote:
> > Hectic day at work? :)
> 
> I' m not working today, decorating is even more stressful :(
 
Sign in my local paint store:

"Husbands choosing colours must have a note from their wives"

I feel your pain. I redid a bathroom sink the other day and am deftly avoiding 
the looming repaint of the living room and one bedroom :-)

-- 
alan dot mckinnon at gmail dot com

Re: [gentoo-user] strange cron messages...

[Alex Schuster]

Mick writes:

> On Saturday 14 November 2009 16:53:24 Alex Schuster wrote:

> > Something like that, I never used logrotate by myself. See the man
> > page for more information.
> 
> Hmm ... how do you keep your log files under control?

I am using app-admin/metalog (http://metalog.sourceforge.net/) as logger. 
It does not create single log files, but directories, containing multiple 
files, and does the rotation itself. The current file's name is 'current', 
the others have a time stamp in it. You can limit the maximum length or 
time, and the total number of files. I have it set up so that I get one 
file per day, and keep the last 30 files, so I have the complete log of 
one month.

	Wonko

Re: [gentoo-user] strange cron messages...

[Jarry]

Alex Schuster wrote:
>> SUBJECT: Cron <root@obelix> test -x /usr/sbin/run-crons &&
>> /usr/sbin/run-crons
>> error: kernel:9 unknown option 'compytruncate' -- ignoring line
>> error: kernel:12 unknown option 'endscript' -- ignoring line
>> ------------------
> I assume you are using logrotate, and have the /etc/logrotate.d/kernel 
> file? I guess the 'compytruncate' is misspelled and should be 
> 'copytruncate'. And 'endscript' is used after using 'prerotate' or 
> 'postrotate', which you probably do not have.

You are right: I just quickly created logrotate config for kernel
by copying from other config, misspeled that "compytruncate",
erased "postrotate" script but forgot to delete "endscript".
I completely forgot about this change, and when I received
email with "error: kernel" I immediatelly thought of some
kernel misconfiguration...

> Something like that, I never used logrotate by myself. See the man page 
> for more information.

Let me ask: how do you deal with /var/log/wtmp? I think it does not
go through syslog, and even it it does, it is not easy to process it
whit that syslog-macro because it is not pure text file. Do you
let it grow forever? Or how do you transfer it to log-server?

Jarry

-- 
_______________________________________________________________
This mailbox accepts e-mails only from selected mailing-lists!
Everything else is considered to be spam and therefore deleted.

Re: [gentoo-user] strange cron messages...

[Alex Schuster]

Jarry writes:

> Alex Schuster wrote:

> > Something like that, I never used logrotate by myself. See the man
> > page for more information.
> 
> Let me ask: how do you deal with /var/log/wtmp? I think it does not
> go through syslog, and even it it does, it is not easy to process it
> whit that syslog-macro because it is not pure text file. Do you
> let it grow forever? Or how do you transfer it to log-server?

I just let it grow and grow and grow... on my server, which is running 
Gentoo for seven years now, it has 27,000 entries, and is at 24 MB. This 
is okay for me, and I like that I can I see when my fist login on the 
system was.
If space is a concern, you can rename the file and compress it (compress 
ratio here is 97%), and create is as empty again with 'touch 
/var/log/wtmp'.

	Wonko

Re: [gentoo-user] strange cron messages...

[Neil Walker]

Alex Schuster wrote:
> I just let it grow and grow and grow... on my server, which is running 
> Gentoo for seven years now, it has 27,000 entries, and is at 24 MB.

Wow! Do you even need a server? It can't be doing much. My servers top that
in a few hours.   ;)


Be lucky,

Neil
http://www.easy-ebay.com

Re: [gentoo-user] strange cron messages...

[Alan McKinnon]

On Monday 16 November 2009 22:09:11 Neil Walker wrote:
> Alex Schuster wrote:
> > I just let it grow and grow and grow... on my server, which is running
> > Gentoo for seven years now, it has 27,000 entries, and is at 24 MB.
> 
> Wow! Do you even need a server? It can't be doing much. My servers top that
> in a few hours.   ;)

I have to ask - what the blazes are those servers doing???  :-)

My main shell/jump box has 400-odd users and routinely runs 600+ concurrent 
ssh sessions. wtmp averages about 1M and 1400 entries a day

-- 
alan dot mckinnon at gmail dot com

Re: [gentoo-user] strange cron messages...

[Neil Walker]

Alan McKinnon wrote:
> I have to ask - what the blazes are those servers doing???  :-)
>   

HTTP, SMTP and IMAP, mostly. ;)


Be lucky,

Neil
http://www.easy-ebay.com

Re: [gentoo-user] strange cron messages...

[Alan McKinnon]

On Tuesday 17 November 2009 04:35:23 Neil Walker wrote:
> Alan McKinnon wrote:
> > I have to ask - what the blazes are those servers doing???  :-)
> 
> HTTP, SMTP and IMAP, mostly. ;)

Which raises another question I have to ask - why are those logging to wtmp? 
Do all your users have shell accounts and do the services use Unix auth?

-- 
alan dot mckinnon at gmail dot com

Re: [gentoo-user] strange cron messages...

[Alex Schuster]

Neil Walker writes:

> Alex Schuster wrote:
> > I just let it grow and grow and grow... on my server, which is
> > running Gentoo for seven years now, it has 27,000 entries, and is at
> > 24 MB.
> 
> Wow! Do you even need a server? It can't be doing much. My servers top
>  that in a few hours.   ;)

It's a P3 with 500 MHz and 256 MB of RAM only. But I think I need it. It 
is my internet gateway, CVS and mail server, has CUPS and FTP, and an 
apache running, mainly for my little company's wiki, but also for having 
some little space for stuff to post. It also serves multimedia data over 
NFS for the other systems in the house. And it's my name server, with all 
those virtual machines I have some dozen systems here.

But there are not many user logins on that machine. It's mostly myself 
logging in and using the ISDN line for remote some administration.

But... what the heck are your servers doing?

	Wonko