0

I have a inotifywait on syslog. It works without issue until the log rolls over.

Although the same filename is used, the new file is a new file and inotify loses its reference.

How do we compensate for this to maintain the watch through the log rollover?

4
  • Have you tried monitoring the containing directory to detect and respond to the creation of the new file after roll-over? – Andy Dalton Aug 2 '20 at 1:13
  • @AndyDalton That'a good suggestion but instead I have a function setup to init the watch and monitor the file events I'm interested in. On the MOVE_SELF event I make a recursive call to the setup function. That might be a spectacularly bad solution but I'm just a hobbyist so no real damage. A regular restart of the service should ward off disaster but I'm interested in what will happen. How does bash handle recursion? – Stephen Boston Aug 2 '20 at 1:44
  • 1
    You could restart your iwatch as part of the log rollover. man logrotate logrotate.conf. – waltinator Aug 2 '20 at 3:24
  • @waltinator Oh yeah! With the postrotate property. Thanks. – Stephen Boston Aug 2 '20 at 3:36
1

You could restart your iwatch as part of the log rollover. man logrotate logrotate.conf.

added by OP:

The installed logrotate.conf (as of Ubuntu 20.04) is configured to read the contents of /etc/logrotate.d. In that directory, the syslog configuration is in rsyslog. In that file there is a syslog section as below which I modified as indicated.

 /var/log/syslog
 {
    rotate 7
    daily
    missingok
    notifempty
    delaycompress
    compress
    postrotate
        /usr/lib/rsyslog/rsyslog-rotate
       <MY MONITOR SCRIPT HERE> 
    endscript
 }
 

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.