memic at paniert.org
Thu Sep 14 17:33:31 EST 2006
ah, ok, somehow i have read over this, thx for poiting out.
my rotation script now looks like this:
PID=`pgrep -f "flowd: monitor"`
/bin/mv /var/log/flow/flowd.bin /var/log/flow/$DATE-flow.bin
/bin/kill -SIGUSR1 $PID
are you sure no flows can get lost this way?
Gijs Molenaar wrote:
> memic wrote:
>> i was wondering whats the best solution to rotate the flowd logfiles,
>> im doing it atm
>> with a very simple bash script:
>> # cat /usr/local/bin/flowd-logrotate.sh
>> PID=`pgrep -f "flowd: monitor"`
>> /bin/echo $PID
>> DATE=`date +%Y%m%d`
>> /bin/mv /var/log/flow/flowd.bin /var/log/flow/$DATE-flow.bin
>> /bin/kill -HUP $PID
>> with a cron like that:
>> 0 0 * * * /usr/local/bin/flowd-logrotate.sh
> In the man page (flowd.8) you can find this:
> flowd may be terminated by sending it a SIGTERM signal. Upon
> receipt of a SIGUSR1 flowd will close and reopen its logfile. This is
> useful for
> rotating logs. When flowd receives a SIGHUP it will re-read its
> configuration and re-open its logfile. Some basic runtime statistics
> will be
> logged when flowd is signalled with SIGUSR2 or SIGINFO.
> Sending the HUP signal will work, but maybe some flows are lost (not
> sure). The best thing is to replace HUP with SIGUSR1.
More information about the netflow-tools