[Logcheck-devel] Bug#271410: logcheck: avoid missed messages when logs rotate

[Ross Johnson]

Package: logcheck
Version: 1.2.25
Severity: wishlist


According to crontab on my system, logcheck runs at 2 minutes after the hour, but logrotate runs at 25 minutes after the hour.  As a result, there is a 23 minute window each day where logcheck does not process log messages (for daily rotated logs).  I would like something that eliminates this window.  One solution is to add the .0 or .1 version of all the filenames in logcheck.logfiles, but then most messages get processed twice.  Another parital solution is to insert the following right before logrotate executes in /etc/cron.daily/logrotate:
	/usr/bin/sudo -u logcheck /usr/sbin/logcheck
There's still a window for the second solution, but it's much smaller.  Is there a better way?

-- System Information:
Debian Release: 3.1
  APT prefers testing
  APT policy: (500, 'testing'), (50, 'unstable')
Architecture: i386 (i686)
Kernel: Linux 2.6.7-1-k7
Locale: LANG=en_US, LC_CTYPE=en_US

Versions of packages logcheck depends on:
ii  adduser          3.59                    Add and remove users and groups
ii  cron             3.0pl1-86               management of regular background p
ii  debconf [debconf 1.4.30.3                Debian configuration management sy
ii  debianutils      2.8.4                   Miscellaneous utilities specific t
ii  exim4            4.34-4sarge1            An MTA (Mail Transport Agent)
ii  exim4-daemon-hea 4.34-4sarge1            Exim (v4) with extended features, 
ii  lockfile-progs   0.1.10                  Programs for locking and unlocking
ii  logcheck-databas 1.2.25                  A database of system log rules for
ii  logtail          1.2.25                  Print log file lines that have not
ii  mailx            1:8.1.2-0.20040524cvs-1 A simple mail user agent
ii  perl             5.8.4-2                 Larry Wall's Practical Extraction 
ii  syslog-ng [syste 1.6.4-1                 Next generation logging daemon

-- debconf information excluded