View difference between Paste ID: 5L1ERv6b and 4tN3FWeS
SHOW: | | - or go back to the newest paste.
1
executable script /etc/cron.daily/logrotate has in it, amount other things, the command:
2
  /usr/sbin/logrotate /etc/logrotate.conf
3
4
/etc/logrotate.conf has in it, among other things
5
  include /etc/logrotate.d
6
7
/etc/logrotate.d/syslog-ng has in it, among other things:
8
  /var/log/remote/*/*.txt
9
  {
10
        rotate 8
11
        maxage 30
12
        daily
13
        missingok
14
        compress
15
        delaycompress
16
        postrotate
17
                invoke-rc.d syslog-ng reload > /dev/null
18
        endscript
19
  }
20
21
That was set that way yesterday just before noon.
22
23
An example directory listing for /var/log/remote/10.128.0.3/log.txt shows only
24
  drwxr-xr-x  2 root adm      4096 May 26 11:49 ./
25
  drwxr-xr-x 24 root adm      4096 May 26 23:10 ../
26
  -rw-r--r--  1 root adm 456943474 May 27 14:55 log.txt
27
28
And finally, log.txt in there has lines covering the period:
29
head -n 2 log.txt && tail -n 2 log.txt
30
  May 26 11:38:02 10.128.0.3 %ASA-5-304001: 10.134.0.104 Accessed URL 108.168.240.194:http://tags.[snip]
31
  May 26 11:38:02 10.128.0.3 %ASA-5-304001: 10.134.0.104 Accessed URL 98.139.225.42:http://ads.yahoo[snip]
32
  May 27 14:56:54 10.128.0.3 %ASA-5-304001: 10.144.0.76 Accessed URL 98.139.199.205:https://98.139.199.205/
33
  May 27 14:56:54 10.128.0.3 %ASA-5-304001: 10.168.0.62 Accessed URL 23.74.9.136:http://crl.microsoft.[snip]
34
35-
I would have expected to see log.txt.1, or log.txt.1.gz and log.txt.  The old file should have covered yesterday before lunch through midnight last night and the current file should have been all the stuff starting at midnight last night until the current time.
35+
/var/lib/logrotate/status contains a line for the above sample directory:
36
  "/var/log/remote/10.128.0.3/log.txt" 2015-5-27-6:0:0
37
38
I don't know how to interpret the "-6:0:0" in the line above.