On Mon, Dec 17, 2007 at 01:59:57PM +1000, Alexandr Isaev wrote:
> Имеем стандартные логи от snort:
> 
> #ls -l /var/log/snort
> -rw------- 1 snort snort 10778160 Дек 17 13:30 alert
> -rw------- 1 snort snort      651 Дек 13 11:05 snort.log.1197507874
> -rw------- 1 snort snort  5919270 Дек 17 13:30 snort.log.1197509314
> -rw------- 1 snort snort      205 Дек 13 12:09 snort.log.1197511518
> -rw------- 1 snort snort     3719 Дек 13 15:48 snort.log.1197524772
> -rw------- 1 snort snort     4165 Дек 13 15:50 snort.log.1197524897
> -rw------- 1 snort snort      710 Дек 13 15:53 snort.log.1197525128
> -rw------- 1 snort snort      207 Дек 13 15:54 snort.log.1197525245
> -rw------- 1 snort snort  5733048 Дек 17 13:02 snort.log.1197527259
> -rw------- 1 snort snort    17992 Дек 17 13:30 snort.log.1197860539
> 
> и стандартный логротейт файл из пакета snort:
> 
> # [root@avi logrotate.d]# cat /etc/logrotate.d/snort
> /var/log/snort/* {
>      daily
>      rotate 7
>      missingok
>      compress
>      postrotate
>          /sbin/service snortd condreload 2>/dev/null || true
>      endscript
> }
> 
> /var/log/snort/*/* {
>      daily
>      rotate 7
>      missingok
>      compress
>      postrotate
>          /sbin/service snortd condreload 2>/dev/null || true
>      endscript
> }
> 
> а теперь запускаем logrotate на эту конструкцию:
> 
> # logrotate -d /etc/logrotate.d/snort
> reading config file /etc/logrotate.d/snort
> Ignoring /var/log/snort/snort.log.1197507874, because of ".1197507874" 
> ending
> Ignoring /var/log/snort/snort.log.1197509314, because of ".1197509314" 
> ending
> Ignoring /var/log/snort/snort.log.1197511518, because of ".1197511518" 
> ending
> Ignoring /var/log/snort/snort.log.1197524772, because of ".1197524772" 
> ending
> Ignoring /var/log/snort/snort.log.1197524897, because of ".1197524897" 
> ending
> Ignoring /var/log/snort/snort.log.1197525128, because of ".1197525128" 
> ending
> Ignoring /var/log/snort/snort.log.1197525245, because of ".1197525245" 
> ending
> Ignoring /var/log/snort/snort.log.1197527259, because of ".1197527259" 
> ending
> Ignoring /var/log/snort/snort.log.1197860539, because of ".1197860539" 
> ending
> End of reading config info for /var/log/snort/*
> error: error accessing /var/log/snort/*: No such file or directory
> error: /etc/logrotate.d/snort:11 glob failed for /var/log/snort/*/*

А зачем вам понадобился /var/log/snort/*/*?


-- 
ldv