Bug#391892: exim4-base: combination of logrotate file and cron.d file result in spurious warning mails

[Stephen Gran]

This one time, at band camp, Marc Haber said:
> On Mon, Oct 09, 2006 at 01:14:59PM +0100, Stephen Gran wrote:
> > 
> > I manually fixed the syntax error, reload exim, move on.
> 
> Mistake here. Rotate panicloc is missing. The paniclog should always
> be empty, and if it's not, that is alarm signal. Upstream docs suggest
> this mode of operation.

You mean you expect admins to manually do:
rm /var/log/exim4/pancilog.100.gz
mv /var/log/exim4/pancilog.99.gz /var/log/exim4/pancilog.100.gz
mv /var/log/exim4/pancilog.98.gz /var/log/exim4/pancilog.99.gz
....

That's why we have invented automation tools, like for instance,
logrotate.

> > This is suboptimal, IMHO.  paniclog _is_ rotated if it's greater than
> > 10M, so it's not the case that paniclog isn't rotated until the admin
> > deals with the problem (which would be one way to go, although I
> > disagree that it's helpful when you're admin'ning a hundred machines).
> > It's only true that paniclog isn't rotated until it reaches a certain
> > size.  I would prefer it if it switched back to daily.  The exim4-base
> > cron.daily would still send an email before rotation, since it's script
> > is lexically before logrotate,
> 
> That's a side effect and cannot be relied on. Additionally, it would
> only send a _single_ e-mail.

This is also the case when paniclog is greater than 10M in size.  I am
arguing that if you handle rotation at all, it should be consistent.
The argument that you want to alert for all eternity, unless the log
file gets too big, doesn't feel consistent to me.

> >  but the admin doesn't get infinite repeats.  Frankly, if the admin
> >  can't deal with the problem the first time they see paniclog has
> >  errors, they probably aren't going to deal with it the next hundred
> >  times.
> 
> I tend to forget taking care of some things.

I do to, but that's why I add paniclog to logcheck.  I prefer the single
problem, single alert method of handling things.  If it's an ongoing
problem that continues to write to paniclog, I want to continue to
be notified.  But I really don't want a hundred emails every morning
for a problem I already fixed on all the affected machines.
-- 
 -----------------------------------------------------------------
|   ,''`.                                            Stephen Gran |
|  : :' :                                        sgran at debian.org |
|  `. `'                        Debian user, admin, and developer |
|    `-                                     http://www.debian.org |
 -----------------------------------------------------------------
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
Url : http://lists.alioth.debian.org/pipermail/pkg-exim4-maintainers/attachments/20061009/b3103def/attachment.pgp