Plugins: [c-icap] logrotation?

[Stephanowicz]

I'm just wondering if there's any logrotation implemented - our c-icap accesslog is growing bigger and bigger... ;)

Cheers, Stephan

[fichtner]

This should already be pluggable, so it just needs checked-in file or template in the plugin:

https://github.com/opnsense/core/blob/86996d7bf74d7eadcd0879d8edb5aa3d7f807b32/src/opnsense/service/templates/OPNsense/Syslog/newsyslog.conf#L21

[mimugmail]

Something like this?

root@OPNsense:~ # cat /etc/newsyslog.conf.d/c-icap
# logfilename                   [owner:group]   mode    count size      when    flags   [/pid_file]               [sig_num]
/var/log/c-icap/access.log    c_icap:c_icap     644     2       *       @T00     ZB      /var/run/c-icap/c-icap.pid       30
/var/log/c-icap/server.log    c_icap:c_icap     644     2       *       @T00     ZB      /var/run/c-icap/c-icap.pid       30

[Stephanowicz]

Yep! Thank You - just tried it & works fine!

Cheers,
Stephan

[Stephanowicz]

"Zu früh gefreut" ;)
the service didn't restart -
hmm, I see a c-icap .ctl in /var/run/c-icap/ and a pid-file... is that normal?
I just started c-icap from the web console. The timestamp from the pid-file has this time

• the timestap from the ctl-file is 2 days old - this fits to the last bootup time.

[mimugmail]

@fichtner I copied the file from squid where signal "30" is sent, seems this is not enough for c-icap.
Which signal number would be a restart?

Also a relog sent to the daemon would be fine, but don't know if newsyslog is able to do this
https://sourceforge.net/p/c-icap/mailman/message/35220461/

[fichtner]

found info from OpenBSD.. not sure if entirely compatible with FreeBSD synax, but may have a clue. https://github.com/toddfries/OpenBSD-ports-patches/blob/master/www/c-icap/c-icap/patches/patch-c-icap_conf_in#L58-L62

[Stephanowicz]

Hi,

I tried it with this in the newsyslog conf :
/var/log/c-icap/access.log c_icap:c_icap 644 7 2048 @T00 RZB /usr/local/etc/c-icap/relogicap
and this in the script _/usr/local/etc/c-icap/relogicap_ :

#!/bin/sh
echo -n relog > /var/run/c-icap/c-icap.ctl

dunno - I get an errormessage:

root@lifesense:~ # newsyslog
sh: /usr/local/etc/c-icap/relogicap: not found
newsyslog: /usr/local/etc/c-icap/relogicap 1: returned non-zero exit code: 32512

but the log gets rotated and c-icap is running...?

[Stephanowicz]

(uups - sry, didn't want to close it - at least not as long it isn't solved :) )

forgot to say, that calling the script directly is working and its permission is 755

Edit: tried it with sh and it's not working
I'm not used to bsd - what shell can I use in the script?
Though this is more confusing - why does it work calling the script from command line??

[Stephanowicz]

Ok - again my fault...
misspelled the filename in the newsyslog conf:
it has to be
/usr/local/etc/c-icap/relogcicap
And it is working!

Thanks for Your help!

[Stephanowicz]

LOL - again wrong button!
Forgive me! xD

[mimugmail]

I think I have an easier solution, just remove everything after ZB, then the default is to send a SIGHUP to the process. Worked for me. Please check on your side.

[Stephanowicz]

Nope, sorry - it's still running but not logging any longer.
Only after a manual echo -n relog > /var/run/c-icap/c-icap.ctl it's logging again...

[mimugmail]

Please post the content of the file and have you restarted syslog? For me it's working and logfile is growing:

root@OPNsense:~/frr # ps uafx | grep c-
c_icap 70549   0.0  0.2   23324   3152  -  Ss   13:39      0:02.59 /usr/local/bin/c-icap -f /usr/local/etc/c-icap/c-icap.conf
c_icap 77420   0.0  0.2   39088   4548  -  S    19:00      0:01.93 /usr/local/bin/c-icap -f /usr/local/etc/c-icap/c-icap.conf
c_icap 77612   0.0  0.2   39088   4620  -  S    19:00      0:02.01 /usr/local/bin/c-icap -f /usr/local/etc/c-icap/c-icap.conf
c_icap 77806   0.0  0.2   24752   3464  -  S    19:00      0:01.87 /usr/local/bin/c-icap -f /usr/local/etc/c-icap/c-icap.conf
root   51140   0.0  0.1 1080488   2832  0  S+   09:56      0:00.00 grep c-
root@OPNsense:~/frr # ps uafx | grep c-
c_icap  8945   0.0  0.2   24752   3484  -  S    10:00      0:00.01 /usr/local/bin/c-icap -f /usr/local/etc/c-icap/c-icap.conf
c_icap  8973   0.0  0.2   24752   3484  -  S    10:00      0:00.01 /usr/local/bin/c-icap -f /usr/local/etc/c-icap/c-icap.conf
c_icap  9151   0.0  0.2   24752   3484  -  S    10:00      0:00.01 /usr/local/bin/c-icap -f /usr/local/etc/c-icap/c-icap.conf
c_icap 70549   0.0  0.2   23324   3172  -  Ss   13:39      0:02.61 /usr/local/bin/c-icap -f /usr/local/etc/c-icap/c-icap.conf
root   83983   0.0  0.1 1080488   2832  0  S+   10:05      0:00.00 grep c-
root@OPNsense:~/frr # ls -la /var/log/c-icap/
total 28
drwxr-x---  2 c_icap  c_icap   512 Sep 18 10:00 .
drwxr-xr-x  9 root    wheel   1024 Sep 16 03:01 ..
-rw-r--r--  1 c_icap  c_icap     0 Sep 18 10:00 access.log
-rw-r--r--  1 c_icap  c_icap  1480 Sep 18 10:00 access.log.0.gz
-rw-r--r--  1 c_icap  c_icap   446 Sep 17 19:00 access.log.1.gz
-rw-r--r--  1 c_icap  c_icap   195 Sep 18 10:00 server.log
-rw-r--r--  1 c_icap  c_icap   441 Sep 18 10:00 server.log.0.gz
-rw-r--r--  1 c_icap  c_icap   202 Sep 17 19:00 server.log.1.gz
root@OPNsense:~/frr # ls -la /var/log/c-icap/
total 40
drwxr-x---  2 c_icap  c_icap   512 Sep 18 10:00 .
drwxr-xr-x  9 root    wheel   1024 Sep 16 03:01 ..
-rw-r--r--  1 c_icap  c_icap  8949 Sep 18 10:05 access.log
-rw-r--r--  1 c_icap  c_icap  1480 Sep 18 10:00 access.log.0.gz
-rw-r--r--  1 c_icap  c_icap   446 Sep 17 19:00 access.log.1.gz
-rw-r--r--  1 c_icap  c_icap   361 Sep 18 10:05 server.log
-rw-r--r--  1 c_icap  c_icap   441 Sep 18 10:00 server.log.0.gz
-rw-r--r--  1 c_icap  c_icap   202 Sep 17 19:00 server.log.1.gz

[Stephanowicz]

I think I have an easier solution, just remove everything after ZB, then the default is to send a SIGHUP to the process. Worked for me. Please check on your side.

Well, I did it like that... ;)
I tried it again, but this time I also kept the path to the pid-file - probably You meant it like this..?

And yes, it's working!

So my newsyslog line looks like this

/var/log/c-icap/access.log c_icap:c_icap 644 7 4096 @T00 ZB /var/run/c-icap/c-icap.pid

[mimugmail]

Same as mine, but do you really want size 4MB?

[Stephanowicz]

too low or too high? :)

at moment I even don't understand the sense of THIS log - quite useless to me - the interesting things (viruses) get logged to the server.log

An option to disable the access.log would be best (for me)

Regarding options: it would be nice to add the logrotation options like size, filenumber etc to the settings - also a tab with current server.log would be nice^^

Finally - I think we will also need this for clam-av?

[mimugmail]

I don't use access.log, just let it as default. I'll add an Enable button for access log.
A logviewer for server.log is a good idea, clamav also, but this would be low priority at the moment.

[Stephanowicz]

Thanx!

Well, I mainly meant the logrotation for clam-av, as I think it's also not configured...?

[mimugmail]

LogFileMaxSize is 1M, it won't grow bigger

[Stephanowicz]

What do You mean? Is this regulated by newsyslog or internally by the prog itself?

If this is handled by newsyslog, I don't think this is quite efficient depending on how the web is frequented by the users.
Our log once grew over 10 mb in approx 12 hours... this means 1 backup ~each hour...

Nevertheles I'd like to disable the access.log completely ;)

[mimugmail]

I pushed some changes for disabling it, perhaps it will be in 17.7.3 if it fits the timeline and get's accepted, if not then 17.7.4

[fichtner]

17.7.3 is already built, sorry ;)