Skynet Skynet log file keeps resetting

[Khadanja]

I have scribe installed and my skynet-0.log file keeps resetting. There is another log file in skynet folder in usb drive which also seems to reset. Is this normal? I thought if the log file gets reset or rotated, older version is still preserved by scribe?

 

[elorimer]

I have scribe installed and my skynet-0.log file keeps resetting. There is another log file in skynet folder in usb drive which also seems to reset. Is this normal? I thought if the log file gets reset or rotated, older version is still preserved by scribe?

Not sure what you mean by "resetting", but every hour skynet looks at the log, summarizes all its messages into a new single line and deletes all the messages of the last hour. Then logrotate each day will look at that file, and if it is too big, rotates the log. Logrotate keeps the last five logs, but you can change that. The skynet log doesn't grow very fast because it is only 1 line an hour plus an hours worth of new messages.

 

[Khadanja]

B

Not sure what you mean by "resetting", but every hour skynet looks at the log, summarizes all its messages into a new single line and deletes all the messages of the last hour. Then logrotate each day will look at that file, and if it is too big, rotates the log. Logrotate keeps the last five logs, but you can change that. The skynet log doesn't grow very fast because it is only 1 line an hour plus an hours worth of new messages.

By resetting I meant a new Skynet-0.log file is created and I’m not sure where the old one goes and I can’t search Skynet stats for older events like few days old. Where does logrotate keep the last 5 Skynet log files?

 

[elorimer]

You can't search skynet events more than an hour ago, ever. Skynet rolls them up each hour into a single line in its log.

Logrotate doesn't usually come into this because the skynet log is so small after it does its hourly scrub. But in scribe's world it will be /opt/var/log as usual.

Scribe is basically a script that manages syslog-ng. Never paid attention to it, but if you are seeing a "new" skynet-0.log file I think it is an artifact of file open/close.

If you really want to see old skynet logs it is trivial to have scribe (and thus syslog-ng) log each message also to another location and logrotate that. Not sure I follow why I would do that, or log losing lottery tickets, but OK.