hi, i was wondering whats the best solution to rotate the flowd logfiles, im doing it atm with a very simple bash script: # cat /usr/local/bin/flowd-logrotate.sh #!/bin/bash PID=`pgrep -f "flowd: monitor"` /bin/echo $PID DATE=`date +%Y%m%d` /bin/mv /var/log/flow/flowd.bin /var/log/flow/$DATE-flow.bin /bin/kill -HUP $PID with a cron like that: 0 0 * * * /usr/local/bin/flowd-logrotate.sh regards, memic
memic wrote:> hi, > > i was wondering whats the best solution to rotate the flowd logfiles, im > doing it atm > with a very simple bash script: > > # cat /usr/local/bin/flowd-logrotate.sh > #!/bin/bash > PID=`pgrep -f "flowd: monitor"` > /bin/echo $PID > DATE=`date +%Y%m%d` > /bin/mv /var/log/flow/flowd.bin /var/log/flow/$DATE-flow.bin > /bin/kill -HUP $PID > > with a cron like that: > > 0 0 * * * /usr/local/bin/flowd-logrotate.sh >In the man page (flowd.8) you can find this: flowd may be terminated by sending it a SIGTERM signal. Upon receipt of a SIGUSR1 flowd will close and reopen its logfile. This is useful for rotating logs. When flowd receives a SIGHUP it will re-read its configuration and re-open its logfile. Some basic runtime statistics will be logged when flowd is signalled with SIGUSR2 or SIGINFO. Sending the HUP signal will work, but maybe some flows are lost (not sure). The best thing is to replace HUP with SIGUSR1. gr, gijs
ah, ok, somehow i have read over this, thx for poiting out. my rotation script now looks like this: #!/bin/bash PID=`pgrep -f "flowd: monitor"` /bin/echo $PID DATE=`date +%Y%m%d` /bin/mv /var/log/flow/flowd.bin /var/log/flow/$DATE-flow.bin /bin/kill -SIGUSR1 $PID are you sure no flows can get lost this way? Gijs Molenaar wrote:> memic wrote: >> hi, >> >> i was wondering whats the best solution to rotate the flowd logfiles, >> im doing it atm >> with a very simple bash script: >> >> # cat /usr/local/bin/flowd-logrotate.sh >> #!/bin/bash >> PID=`pgrep -f "flowd: monitor"` >> /bin/echo $PID >> DATE=`date +%Y%m%d` >> /bin/mv /var/log/flow/flowd.bin /var/log/flow/$DATE-flow.bin >> /bin/kill -HUP $PID >> >> with a cron like that: >> >> 0 0 * * * /usr/local/bin/flowd-logrotate.sh >> > > > In the man page (flowd.8) you can find this: > flowd may be terminated by sending it a SIGTERM signal. Upon > receipt of a SIGUSR1 flowd will close and reopen its logfile. This is > useful for > rotating logs. When flowd receives a SIGHUP it will re-read its > configuration and re-open its logfile. Some basic runtime statistics > will be > logged when flowd is signalled with SIGUSR2 or SIGINFO. > > Sending the HUP signal will work, but maybe some flows are lost (not > sure). The best thing is to replace HUP with SIGUSR1. > > > gr, > > gijs > >
memic wrote:> ah, ok, somehow i have read over this, thx for poiting out. > > my rotation script now looks like this: > > #!/bin/bash > PID=`pgrep -f "flowd: monitor"` > /bin/echo $PID > DATE=`date +%Y%m%d` > /bin/mv /var/log/flow/flowd.bin /var/log/flow/$DATE-flow.bin > /bin/kill -SIGUSR1 $PID > > are you sure no flows can get lost this way?Yep. When you move the file, flowd still writes data to the it, because the inode doesn''t change. After flowd receives the SIGUSR it directly starts to log to the new file. - gijs
On 9/14/06, Gijs Molenaar <gijs at looze.net> wrote:> memic wrote: > > #!/bin/bash > > PID=`pgrep -f "flowd: monitor"` > > /bin/echo $PID > > DATE=`date +%Y%m%d` > > /bin/mv /var/log/flow/flowd.bin /var/log/flow/$DATE-flow.bin > > /bin/kill -SIGUSR1 $PID > > > > are you sure no flows can get lost this way? > > Yep. When you move the file, flowd still writes data to the it, because > the inode doesn''t change. > > After flowd receives the SIGUSR it directly starts to log to the new file.Wouldn''t the use of an automated log rotation utility like logrotate or newsyslog work well for this as well? DS
Darren Spruell wrote:> On 9/14/06, Gijs Molenaar wrote: > >> memic wrote: >> >>> #!/bin/bash >>> PID=`pgrep -f "flowd: monitor"` >>> /bin/echo $PID >>> DATE=`date +%Y%m%d` >>> /bin/mv /var/log/flow/flowd.bin /var/log/flow/$DATE-flow.bin >>> /bin/kill -SIGUSR1 $PID >>> >>> are you sure no flows can get lost this way? >>> >> Yep. When you move the file, flowd still writes data to the it, because >> the inode doesn''t change. >> >> After flowd receives the SIGUSR it directly starts to log to the new file. >> > > Wouldn''t the use of an automated log rotation utility like logrotate > or newsyslog work well for this as well? >just a matter of taste... - gijs