0

I have a inotifywait on syslog. It works without issue until the log rolls over.

Although the same filename is used, the new file is a new file and inotify loses its reference.

How do we compensate for this to maintain the watch through the log rollover?

4
  • Have you tried monitoring the containing directory to detect and respond to the creation of the new file after roll-over? Aug 2, 2020 at 1:13
  • @AndyDalton That'a good suggestion but instead I have a function setup to init the watch and monitor the file events I'm interested in. On the MOVE_SELF event I make a recursive call to the setup function. That might be a spectacularly bad solution but I'm just a hobbyist so no real damage. A regular restart of the service should ward off disaster but I'm interested in what will happen. How does bash handle recursion? Aug 2, 2020 at 1:44
  • 1
    You could restart your iwatch as part of the log rollover. man logrotate logrotate.conf.
    – waltinator
    Aug 2, 2020 at 3:24
  • @waltinator Oh yeah! With the postrotate property. Thanks. Aug 2, 2020 at 3:36

1 Answer 1

1

You could restart your iwatch as part of the log rollover. man logrotate logrotate.conf.

added by OP:

The installed logrotate.conf (as of Ubuntu 20.04) is configured to read the contents of /etc/logrotate.d. In that directory, the syslog configuration is in rsyslog. In that file there is a syslog section as below which I modified as indicated.

 /var/log/syslog
 {
    rotate 7
    daily
    missingok
    notifempty
    delaycompress
    compress
    postrotate
        /usr/lib/rsyslog/rsyslog-rotate
       <MY MONITOR SCRIPT HERE> 
    endscript
 }
 

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .