bugtraq - Re: logwatch and logrotate might create a blind spot in reporting

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Wed, 26 Jan 2005 02:42:04 +0000 (UTC)
From: The Tibetan Traveller <garnet@...ait.net>
To: Sami Pitko <sami.pitko@...sala.com>
Cc: BUGTRAQ <bugtraq@...urityfocus.com>
Subject: Re: logwatch and logrotate might create a blind spot in reporting


On Tue, 25 Jan 2005, Sami Pitko wrote:

> There are some ways to make logwatch reports more reliable:
>
>   * set "Archives = yes" in logwatch.conf. You might also want to tune
>     archive settings in /etc/log.d/conf/logfiles/ to prevent unnecessary
>     processing of really old archives. To cover the blind spot with range
>     'yesterday' and weekly rotation, it is usually enough to specify for
>     example "Archive = secure.1" in secure.conf
>
>   * move logwatch and logrotate to happen at midnight
>
>   * change date matching logic in /etc/log.d/scripts to match for example
>     previous 24 hours

or add the following to the logrotate configuration file:

prerotate
  /full/path/logwatch
endscript


Then it will run logwatch just before it rotates the file.