0

I have a inotifywait on syslog. It works without issue until the log rolls over.

Although the same filename is used, the new file is a new file and inotify loses its reference.

How do we compensate for this to maintain the watch through the log rollover?

4
  • Have you tried monitoring the containing directory to detect and respond to the creation of the new file after roll-over? Commented Aug 2, 2020 at 1:13
  • @AndyDalton That'a good suggestion but instead I have a function setup to init the watch and monitor the file events I'm interested in. On the MOVE_SELF event I make a recursive call to the setup function. That might be a spectacularly bad solution but I'm just a hobbyist so no real damage. A regular restart of the service should ward off disaster but I'm interested in what will happen. How does bash handle recursion? Commented Aug 2, 2020 at 1:44
  • 1
    You could restart your iwatch as part of the log rollover. man logrotate logrotate.conf. Commented Aug 2, 2020 at 3:24
  • @waltinator Oh yeah! With the postrotate property. Thanks. Commented Aug 2, 2020 at 3:36

1 Answer 1

1

You could restart your iwatch as part of the log rollover. man logrotate logrotate.conf.

added by OP:

The installed logrotate.conf (as of Ubuntu 20.04) is configured to read the contents of /etc/logrotate.d. In that directory, the syslog configuration is in rsyslog. In that file there is a syslog section as below which I modified as indicated.

 /var/log/syslog { rotate 7 daily missingok notifempty delaycompress compress postrotate /usr/lib/rsyslog/rsyslog-rotate <MY MONITOR SCRIPT HERE> endscript } 

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.