Bug 137676

Summary:	logsentry doesn't handle rotated log files
Product:	Gentoo Linux	Reporter:	Gentoo User <gu>
Component:	New packages	Assignee:	No maintainer - Look at https://wiki.gentoo.org/wiki/Project:Proxy_Maintainers if you want to take care of it <maintainer-needed>
Status:	RESOLVED UPSTREAM
Severity:	normal
Priority:	Normal
Version:	2006.0
Hardware:	All
OS:	Linux
URL:	http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=336265
Whiteboard:
Package list:		Runtime testing required:	---

Description Gentoo User 2006-06-22 17:46:39 UTC

logtail.c in app-admin/logsentry-1.1.1 doesn't attempt to read the additional lines since it's last execution in any log files that have been rotated.  This could result in missed data related to notable events.

Recommendation: add intelligence to logtail.c to look for a rotated file (logfilename.0 or logfilename.1.gz, etc) if the file is smaller or has a different inode since last execution, and include it's contents (since last execution) in the output.

Comment 1 Gentoo User 2006-06-22 18:01:34 UTC

http://bugs.debian.org/cgi-bin/pkgreport.cgi?which=pkg&data=logcheck&archive=no&version=&dist=unstable

See related bug for Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=336265

Comment 2 Sune Kloppenborg Jeppesen (RETIRED) gentoo-dev

2006-06-28 02:51:32 UTC

I fail to see the real security impact here.

Reassigning to bugwranglers since it has no maintainer.

Comment 3 Alex Howells (RETIRED) gentoo-dev

2006-11-16 23:19:32 UTC

Looks like an upstream issue, I'm afraid, and upstream is rather dead ;)

We'll shortly have a new developer onboard maintaining log monitoring / security packages - perhaps it might be feasible to use the stuff Debian has (1.2.50) ??

Resolving as 'not our problem', aka: upstream :)