Where to insert a script to generate a report from auth.log just before rotating it?

Adam Funk a24061 at yahoo.com
Thu Sep 21 10:33:33 UTC 2006

On 2006-09-21, Paul Dwerryhouse <paul at dwerryhouse.com.au> wrote:
> On Wed, Sep 20, 2006 at 04:56:42PM +0100, Adam Funk wrote:
>> A while back on another list I was advised that auth.log (and syslog
>> and a few others) are rotated by /etc/cron.weekly/sysklogd.  I'm now
>> interested in running a Perl program to generate a report from
>> auth.log just before each rotation.
> Wouldn't it be better to run the script on the file after it has been
> rotated (using its new filename, auth.log.0)? If you do it before it's
> rotated, then syslog will still be writing to the file and you might
> miss some information.

Thanks for the excellent suggestion!  I'll do it this way:

#! /bin/sh
#[snipped some stuff]
for LOG in `syslogd-listfiles --weekly`
   if [ -s $LOG ]; then
      savelog -g adm -m 640 -u root -c 4 $LOG >/dev/null

# insert here
/path/to/my_report auth.log.0 |mail -s 'auth.log.0 report' root

# Restart syslogd
/etc/init.d/sysklogd reload-or-restart > /dev/null

More information about the ubuntu-users mailing list