From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <alex_is@sakhalin.ru>
Message-ID: <4765F43D.7080306@sakhalin.ru>
Date: Mon, 17 Dec 2007 13:59:57 +1000
From: Alexandr Isaev <alex_is@sakhalin.ru>
User-Agent: Mozilla/5.0 (X11; U; Linux i686; ru-RU;
	rv:1.8.1.11) Gecko/20071206 SeaMonkey/1.1.7
MIME-Version: 1.0
To: Sisyphus ALT Linux <sisyphus@lists.altlinux.org>
Content-Type: text/plain; charset=KOI8-R; format=flowed
Content-Transfer-Encoding: 8bit
X-Virus-Scanned: amavisd-new at sakhalin.ru
Subject: [sisyphus] =?koi8-r?b?bG9ncm90YXRlIM7FINLP1MXK1MnUIMzPx8kgz9Qg?=
 =?koi8-r?b?c25vcnQ=?=
X-BeenThere: sisyphus@lists.altlinux.org
X-Mailman-Version: 2.1.9
Precedence: list
Reply-To: ALT Linux Sisyphus discussions <sisyphus@lists.altlinux.org>
List-Id: ALT Linux Sisyphus discussions <sisyphus.lists.altlinux.org>
List-Unsubscribe: <https://lists.altlinux.org/mailman/listinfo/sisyphus>,
	<mailto:sisyphus-request@lists.altlinux.org?subject=unsubscribe>
List-Archive: <http://lists.altlinux.org/pipermail/sisyphus>
List-Post: <mailto:sisyphus@lists.altlinux.org>
List-Help: <mailto:sisyphus-request@lists.altlinux.org?subject=help>
List-Subscribe: <https://lists.altlinux.org/mailman/listinfo/sisyphus>,
	<mailto:sisyphus-request@lists.altlinux.org?subject=subscribe>
X-List-Received-Date: Mon, 17 Dec 2007 04:00:11 -0000
Archived-At: <http://lore.altlinux.org/sisyphus/4765F43D.7080306@sakhalin.ru/>
List-Archive: <http://lore.altlinux.org/sisyphus/>
List-Post: <mailto:sisyphus@altlinux.ru>

Имеем стандартные логи от snort:

#ls -l /var/log/snort
-rw------- 1 snort snort 10778160 Дек 17 13:30 alert
-rw------- 1 snort snort      651 Дек 13 11:05 snort.log.1197507874
-rw------- 1 snort snort  5919270 Дек 17 13:30 snort.log.1197509314
-rw------- 1 snort snort      205 Дек 13 12:09 snort.log.1197511518
-rw------- 1 snort snort     3719 Дек 13 15:48 snort.log.1197524772
-rw------- 1 snort snort     4165 Дек 13 15:50 snort.log.1197524897
-rw------- 1 snort snort      710 Дек 13 15:53 snort.log.1197525128
-rw------- 1 snort snort      207 Дек 13 15:54 snort.log.1197525245
-rw------- 1 snort snort  5733048 Дек 17 13:02 snort.log.1197527259
-rw------- 1 snort snort    17992 Дек 17 13:30 snort.log.1197860539

и стандартный логротейт файл из пакета snort:

# [root@avi logrotate.d]# cat /etc/logrotate.d/snort
/var/log/snort/* {
     daily
     rotate 7
     missingok
     compress
     postrotate
         /sbin/service snortd condreload 2>/dev/null || true
     endscript
}

/var/log/snort/*/* {
     daily
     rotate 7
     missingok
     compress
     postrotate
         /sbin/service snortd condreload 2>/dev/null || true
     endscript
}

а теперь запускаем logrotate на эту конструкцию:

# logrotate -d /etc/logrotate.d/snort
reading config file /etc/logrotate.d/snort
Ignoring /var/log/snort/snort.log.1197507874, because of ".1197507874" 
ending
Ignoring /var/log/snort/snort.log.1197509314, because of ".1197509314" 
ending
Ignoring /var/log/snort/snort.log.1197511518, because of ".1197511518" 
ending
Ignoring /var/log/snort/snort.log.1197524772, because of ".1197524772" 
ending
Ignoring /var/log/snort/snort.log.1197524897, because of ".1197524897" 
ending
Ignoring /var/log/snort/snort.log.1197525128, because of ".1197525128" 
ending
Ignoring /var/log/snort/snort.log.1197525245, because of ".1197525245" 
ending
Ignoring /var/log/snort/snort.log.1197527259, because of ".1197527259" 
ending
Ignoring /var/log/snort/snort.log.1197860539, because of ".1197860539" 
ending
End of reading config info for /var/log/snort/*
error: error accessing /var/log/snort/*: No such file or directory
error: /etc/logrotate.d/snort:11 glob failed for /var/log/snort/*/*

/var/log/snort/alert проигнорирован, snort.log.* в общем-то понятно 
почему проигнорированы, но они ротейтятся самим snort-ом поэтому ничего 
страшного, а вот с alert надо что-то делать.