I may have a handle on this.
Nathan, can you please check the following for me.
1. the summary archive for 20081004 is ok.
2 the summary archive for 20081005 is missing.
3. now can you check the summary archive for 20081006 ... I'm interested
in the actual dates for the label and the log records in that
archive ... I suspect it is really data for 20081005.
4. and if that is the case, I suspect you also have the component
archives for 20081006 that have not been merged (although these may well
have been culled by now).
On Wed, 2008-10-08 at 15:03 +1100, Nathan Scott wrote:
> Hi all,
>
> Just wanted to send a note - I've not had an opportunity
> to look into this, and wont soon - perhaps others can in
> the meantime.
>
> On Sunday, we had a daylight savings change (Melbourne,
> Victoria, Australia), clocks going forward one hour at 2am.
> Somehow the daily PCP log rotation scripts have managed
> to delete all of the PCP archives for that day, I presume
> as part of the daily log rotation. We use the recommended
> daily log rotation regime, with daily rotation at 00:10 as
> per the man pages, driven by cron.
>
> This happened on every single host I looked at so far, so
> not some wierd race condition. Presumably something in the
> logic that does the log merge of all individual logs for 1
> day, and then unlinks the old ones has resulted in no "new"
> merged archive (how!?) and yet still removed the "old" ones.
> Looking back, I don't think this is the first time it has
> happened. Argh!
>
> cheers.
>
> --
> Nathan
>
>
|