[Thus spake Luke Mewburn ("LM: ") Tuesday...]

LM: For example, I have the following crontab entries (lines wrapped for
LM: easier reading):
LM:
LM: 	0 6 * * 3 cd /var/log ; logrot -d old -c auth authpriv cron daemon \
LM: 	    ftp kern local0 local1 local2 local3 local4 local5 local6 local7 \
LM: 	    lpr mail news syslog user uucp
LM:
LM: 	20 6 * * 3 cd /var/squid ; logrot -d old -s USR1 -w 60 \
LM: 	    -p /var/run/squid.pid -c -B 'case "\%f" in access*) cat "\%f" | \
LM: 	    calamaris -a | mail -s "proxywww cache report" root;; esac' \
LM: 	    cache access
LM:
LM: 	10 6 * * 3 cd /var/log ; logrot -d old -c \
LM: 	    -N "/etc/rc.d/upslog restart" ups
LM:
LM: 	15 6 * * 3 cd /var/log ; logrot -d old -w 60 \
LM: 	    -N '/etc/rc.d/apache reload' -c \
LM: 	    apache.access apache.error apache.ssl apache.ssl_engine

Could probably actually put all that into scripts, of course, depending
on preference.  But that kind of interface makes much sense.

What could be useful as far as logging is some way to allow a "backlog",
much like is done with databases or filesystems (what's the difference,
really) when you take checkpoints (aka "hot backups") -- you freeze the
current state, copy/move it, then you unfreeze it and let it pick up from
where it left off.  In the case of logging, the extra step of closing and
reopening all the file descriptors (according to the configuration) would
come into play.

...or is this what cronolog handles?

[It just occurred to me that not everything logs through syslog.  This
makes my above suggestion somewhat less than useful.  sorry.]

Globbing would be VERY useful in terms of newsyslog.


LM:
LM: These rotate various files in various directories, storing the compressed
LM: rotated files in ./old/logname.YYMMDD.gz, notifying various services
LM: as appropriate (HUP syslog and squid, reload apache, restart ups-nut, ...).

				--*greywolf;
--
Solaris 2 is not an upgrade from Solaris 1.  They just want you to THINK it is.