Where to insert a script to generate a report from auth.log just before rotating it?

[Adam Funk]

On 2006-09-21, Paul Dwerryhouse <paul at dwerryhouse.com.au> wrote:
> On Wed, Sep 20, 2006 at 04:56:42PM +0100, Adam Funk wrote:
>> A while back on another list I was advised that auth.log (and syslog
>> and a few others) are rotated by /etc/cron.weekly/sysklogd.  I'm now
>> interested in running a Perl program to generate a report from
>> auth.log just before each rotation.
>
> Wouldn't it be better to run the script on the file after it has been
> rotated (using its new filename, auth.log.0)? If you do it before it's
> rotated, then syslog will still be writing to the file and you might
> miss some information.

Thanks for the excellent suggestion!  I'll do it this way:


#! /bin/sh
#[snipped some stuff]
for LOG in `syslogd-listfiles --weekly`
do
   if [ -s $LOG ]; then
      savelog -g adm -m 640 -u root -c 4 $LOG >/dev/null
   fi
done

# insert here
/path/to/my_report auth.log.0 |mail -s 'auth.log.0 report' root

# Restart syslogd
#
/etc/init.d/sysklogd reload-or-restart > /dev/null