Bug#296096: [Logcheck-devel] Bug#296096: logcheck shows the same month old logs again and again

[maximilian attems]

tags 296096 pending
thanks

On Sun, 20 Feb 2005, CAiRO wrote:

> With the normal logcheck emails I constantly get the same reports about month old events that are long ago (and have already been reported several times). It seems it can't remember what it has reported already and what not.

could you please test the attached patch,
works on my system and is added to current logcheck cvs.
would be nice to get feedback if it works for you.

thanks
maks
-------------- next part --------------
Index: src/logcheck
===================================================================
RCS file: /cvsroot/logcheck/logcheck/src/logcheck,v
retrieving revision 1.105
diff -u -r1.105 logcheck
--- src/logcheck	9 Mar 2005 03:10:43 -0000	1.105
+++ src/logcheck	22 Mar 2005 22:55:55 -0000
@@ -398,16 +398,18 @@
 	offsetfile="$STATEDIR/offset$(echo $file|tr / .)"
 	if [ -s $offsetfile -a -r $offsetfile ]; then
 	    if [[ $(wc -c < $file) -lt $(tail -n 1  $offsetfile) ]]; then
-		if [ -e $file.0 ]; then
 	        # assume the log is rotated by savelog(8)
+		# syslog-ng leaves old files here
+		if [ -e $file.0 -a $file.0 -nt $file.1.gz ]; then
 		    debug "Running logtail on rotated: $file.0"
 		    $LOGTAIL -f $file.0 -o $offsetfile $LOGTAIL_OPTS > \
 			$TMPDIR/logoutput/$(basename $file) 2>&1 \
 			|| error "Could not run logtail or save output"
 		    rm -f $offsetfile \
 		        || error "Could not remove $offsetfile"
-		elif [ -e $file.1 ]; then
 		# assume the log is rotated by logrotate(8)
+		# should also probably check if file is still fresh
+		elif [ -e $file.1 ]; then
 		    debug "Running logtail on rotated: $file.1"
 		    $LOGTAIL -f $file.1 -o $offsetfile $LOGTAIL_OPTS > \
 			$TMPDIR/logoutput/$(basename $file) 2>&1 \