You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
As the Debian maintainer of aide, the Advanced Intrusion Detection Environment, I have stumbled upon munin-node's method of logging which seems to be simply dumping info into /var/log/munin/munin-node.log.
The munin Debian packages use logrotate to rotate those logs using the copytruncate option so that munin-node can be kept running and still handles the log correctly.
Unfortunately, this doesn't work well with aide since there is no possibility to handle the log properly in aide.
Removing the copytruncate option from logrotate doesn't work since munin-node will happliy continue logging to the old file.
It is currently necessary to use a postrotate script to restart munin-node. I do not know how much local context is lost with a daily restart.
Would it be possible to either
give munin-node a SIGHUP handler that will re-open the log
close and re-open the log file after logging or
look whether the log file's inode has changed and re-open the log in that case?
Greetings
Marc
The text was updated successfully, but these errors were encountered:
As the Debian maintainer of aide, the Advanced Intrusion Detection Environment, I have stumbled upon munin-node's method of logging which seems to be simply dumping info into /var/log/munin/munin-node.log.
The munin Debian packages use logrotate to rotate those logs using the copytruncate option so that munin-node can be kept running and still handles the log correctly.
Unfortunately, this doesn't work well with aide since there is no possibility to handle the log properly in aide.
Removing the copytruncate option from logrotate doesn't work since munin-node will happliy continue logging to the old file.
It is currently necessary to use a postrotate script to restart munin-node. I do not know how much local context is lost with a daily restart.
Would it be possible to either
Greetings
Marc
The text was updated successfully, but these errors were encountered: