Review question about /var/log/* files.

[Warren Togami]

Phil Knirsch wrote:
> Steve Grubb wrote:
>> On Friday 09 February 2007 08:53, Patrice Dumas wrote:
>>>>> What about the rotated files?
>>>> If you know their exact names ..., why not also %ghost them?
>>> The local admin could have made changes to the logrotate rules.
>>
>> Right, that was my point in mentioning rotated logs. The admin could 
>> have set the number of kept logs to 20. So, the question is why should 
>> 1 file be ghosted when you have this open ended rotate question?
>>
> 
> Thats a real good point. No package pwning^H^H^H^H^H^H owning any 
> logfiles in /var/log/ sounds more and more reasonable. Directories there 
> are a different matter as they clearly are connected to a specific package.
> 
> Read ya, Phil
> 

I always understood that /var/log was supposed to be write-only by the 
respective applications, while other tools like logrotate and logwatch 
allowed processing activities.

It seems inappropriate to me to have a RPM package remove logs that from 
its perspective were supposed to be write-only?

Warren Togami
wtogami at redhat.com