Bug 17022

	In a default installation the entry for "all.log" is commented
        out in syslog.conf, but is active in newsyslog.conf with the result
        that an empty file is rotated and compressed every night.

How-To-Repeat: 
	ls -l /var/log/all*
        -rw-------  1 root  wheel  61 27 Feb 00:00 /var/log/all.log
        -rw-r--r--  1 root  wheel  86 27 Feb 00:00 /var/log/all.log.0.gz

On Sun, 27 Feb 2000 20:32:00 +0100, ncbp@pebbles.tele.dk wrote:

> -/var/log/all.log                       600  7     *    @T00  Z
> +#/var/log/all.log                      600  7     *    @T00  Z

You can't do this without changing the comment in /etc/syslog.conf.
Actually, the comment in syslog.conf already needs changing; it's
misleading in that it can be read to imply that all.log doesn't need to
exist.

Ciao,
Sheldon.

Comment 3 Sheldon Hearn 2000-03-01 07:54:27 UTC

Responsible Changed
From-To: freebsd-bugs->rwatson

This is Robert's invention. 

On Wed, 1 Mar 2000, Sheldon Hearn wrote:

> The following reply was made to PR conf/17022; it has been noted by GNATS.
> 
> From: Sheldon Hearn <sheldonh@uunet.co.za>
> To: ncbp@bank-pedersen.dk
> Cc: FreeBSD-gnats-submit@FreeBSD.ORG
> Subject: Re: conf/17022: newsyslog.conf not in sync with syslog.conf - all.log entry should be commented 
> Date: Wed, 01 Mar 2000 09:54:03 +0200
> 
>  On Sun, 27 Feb 2000 20:32:00 +0100, ncbp@pebbles.tele.dk wrote:
>  
>  > -/var/log/all.log                       600  7     *    @T00  Z
>  > +#/var/log/all.log                      600  7     *    @T00  Z
>  
>  You can't do this without changing the comment in /etc/syslog.conf.
>  Actually, the comment in syslog.conf already needs changing; it's
>  misleading in that it can be read to imply that all.log doesn't need to
>  exist.

The current arrangement worked fine, but the comment should have been
expanded to indicate that the log file should be touch'd before it may be
used.  By default, syslogd will not log to a file that does not already
exist, and newsyslog will not create it.  As such, the newsyslog entry
should be fine (non-existent files won't be rotated).  At least, this is
my experience--were specific problems being experienced or was this a ``it
just seems wrong''?

  Robert N M Watson 

robert@fledge.watson.org              http://www.watson.org/~robert/
PGP key fingerprint: AF B5 5F FF A6 4A 79 37  ED 5F 55 E9 58 04 6A B1
TIS Labs at Network Associates, Safeport Network Services

On Wed, Mar 01, 2000 at 12:50:28PM -0500, Robert Watson wrote:
> On Wed, 1 Mar 2000, Sheldon Hearn wrote:
> 
> > The following reply was made to PR conf/17022; it has been noted by GNATS.
> > 
> > From: Sheldon Hearn <sheldonh@uunet.co.za>
> > To: ncbp@bank-pedersen.dk
> > Cc: FreeBSD-gnats-submit@FreeBSD.ORG
> > Subject: Re: conf/17022: newsyslog.conf not in sync with syslog.conf - all.log entry should be commented 
> > Date: Wed, 01 Mar 2000 09:54:03 +0200
> > 
> >  On Sun, 27 Feb 2000 20:32:00 +0100, ncbp@pebbles.tele.dk wrote:
> >  
> >  > -/var/log/all.log                       600  7     *    @T00  Z
> >  > +#/var/log/all.log                      600  7     *    @T00  Z
> >  
> >  You can't do this without changing the comment in /etc/syslog.conf.
> >  Actually, the comment in syslog.conf already needs changing; it's
> >  misleading in that it can be read to imply that all.log doesn't need to
> >  exist.
> 
> The current arrangement worked fine, but the comment should have been
> expanded to indicate that the log file should be touch'd before it may be
> used.  By default, syslogd will not log to a file that does not already
> exist, and newsyslog will not create it.  As such, the newsyslog entry
> should be fine (non-existent files won't be rotated).  At least, this is
> my experience--were specific problems being experienced or was this a ``it
> just seems wrong''?

Seeing this, I guess it was an ``it just seems wrong'' kind of thing.
The specific problem experienced was triggered because I (for what I
thought would be consistency) touched the logfile myself.
Your experience is right--the file won't get created and thus not
rotated if you don't mess with the defaults.  I guess the PR can be
closed--I'm probably the only one annoyed by what looks like an
inconsistency, but in fact isn't   :-)

Perhaps an addition to the comment in /etc/syslog.conf like
``uncomment this and touch /var/log/all.log to enable logging of all
log messages in one file'' as pointed out by Sheldon Hearn, would be
the best solution.

>   Robert N M Watson 


/Niels Chr.

-- 
 Niels Christian Bank-Pedersen, NCB1-RIPE.
 Network Manager, Tele Danmark NET, IP-section.

 "Hey, are any of you guys out there actually *using* RFC 2549?"

On Wed, 01 Mar 2000 12:50:28 EST, Robert Watson wrote:

> >  You can't do this without changing the comment in /etc/syslog.conf.
> >  Actually, the comment in syslog.conf already needs changing; it's
> >  misleading in that it can be read to imply that all.log doesn't need to
> >  exist.
> 
> The current arrangement worked fine, but the comment should have been
> expanded to indicate that the log file should be touch'd before it may be
> used.

Yes, that's what I was getting at. :-)

Ciao,
Sheldon.

Comment 7 Jeroen Ruigrok van der Werven 2001-10-28 13:33:18 UTC

State Changed
From-To: open->closed

Fixed in v1.17 of syslog.conf 

Thanks!