Where to insert a script to generate a report from auth.log just before rotating it?

[Paul Dwerryhouse]

On Wed, Sep 20, 2006 at 04:56:42PM +0100, Adam Funk wrote:
> A while back on another list I was advised that auth.log (and syslog
> and a few others) are rotated by /etc/cron.weekly/sysklogd.  I'm now
> interested in running a Perl program to generate a report from
> auth.log just before each rotation.

Wouldn't it be better to run the script on the file after it has been
rotated (using its new filename, auth.log.0)? If you do it before it's
rotated, then syslog will still be writing to the file and you might
miss some information.

> Should I just insert my report-generating command into that file at
> one of the points marked below?

It's probably better in the earlier position than in the for-loop. I
still think it would be better off run after rotation though (and after
syslog has been restarted).

Cheers,

Paul

-- 
Paul Dwerryhouse				| PGP Key ID: 0x6B91B584
========================================================================
A look at Ubuntu Server Edition:
http://nepotismia.com/review/ubuntu/server/6.06/