RE: [fwAnalog] fwanalog.all.log too big

From: Micha Silver (Micha~AT~arava.co.il)
Date: Wed Oct 22 2003 - 10:41:44 CEST



Thanks Balazs,

And what will happen to the daily,weekly, monthly reports?

I cycle my kernel log files (where shorewall messages go) every day. These logs get to over 200,000 lines.
THen fwanalog runs after the logrotate. If I 'tail' the end of the fwanalog.all.log *after* my daily run of fwanalog, will I then keep the continuity of the data?

In other words I don't want to chop out so much that I loose some DROP's because they're not in fwanalog.all.log.new and they're also past the inputfiles_mtime="2" log files.

>
> * Micha Silver <Micha~AT~arava.co.il> [2003-10-14 13:55]:
> > Should I just delete the fwanalog.all.log periodically ??
> You can do it, or you can e.g. delete the first X lines, or
> only keep the
> last X lines, there are lots of ways to do it.
>
> Deleting the first 10000 lines:
> $ sed '1,10000d' /path/to/fwanalog.all.log >
> /path/to/fwanalog.all.log.new
> $ mv /path/to/fwanalog.all.log.new /path/to/fwanalog.all.log
>
> Keeping only the last 10000 lines:
> $ tail -10000 /path/to/fwanalog.all.log >
> /path/to/fwanalog.all.log.new
> $ mv /path/to/fwanalog.all.log.new /path/to/fwanalog.all.log
>
> Regards
> --
> ______________________________________________________________
> ___________
> Balázs Bárány balazs~AT~tud.at http://tud.at
> ICQ 10747763
>
> A good engineer will make considerable effort to avoid
> additional effort.
>
> _______________________________________________
> fwAnalog mailing list
> fwAnalog~AT~tud.at
> http://tud.at/cgi-bin/mailman/listinfo/fwanalog
>



This archive was generated by hypermail 2.1.5 : Wed Oct 22 2003 - 20:22:02 CEST