https://bugs.openldap.org/show_bug.cgi?id=10561
--- Comment #2 from Howard Chu hyc@openldap.org --- (In reply to dontbugme.relocate646 from comment #0)
Created attachment 1185 [details] servers/slapd/logging.c surprising behaviors
# OpenLDAP `slapd` log-file engine — observed bugs and pitfalls
This document lists defects and surprising behaviors identified by reading `servers/slapd/logging.c` (the `logfile`, `logfile-format`, `logfile-only` and `logfile-rotate` implementation) in this tree. All line references point to that file.
Scope: these concern the **internal** log file that `slapd` writes itself when `logfile <path>` is configured. They are independent of `rsyslogd`/`syslog-ng`.
## Bug 1 — `loglevel`/`olcLogLevel` messages are *not* written to the logfile unless `logfile-only on`
This is already explicitly documented. https://openldap.org/software/man.cgi?query=slapd.conf&apropos=0&sek...
logfile <filename> Specify a file for recording slapd debug messages. These messages are unrelated to messages exposed by the loglevel configuration parameter.
Calling a behavior "surprising" if one does not read the documentation does not qualify as a bug.
### Severity
High for operators expecting `logfile` + `loglevel` to mirror syslog. The behavior is by design but undocumented as a limitation.
Incorrect and invalid. The behavior is explicitly documented.
## Bug 3 — `logfile-format default` is identical to `logfile-format debug`
Again, this is explicitly documented. Not a bug.
logfile-format debug|syslog-utc|syslog-localtime|rfc3339-utc Specify the prefix format for messages written to the logfile. The debug format is the normal format used for slapd debug messages, with a timestamp in hexadecimal, followed by a thread ID. The other options are to use syslog(3) style prefixes, with timestamps either in UTC or in the local timezone. The default is debug format.
## Bug 5 — Age-based rotation uses inode change time, not file create/modify time
### What happens
When a file is (re)opened, the rotation "birth" timestamp is taken from `st_ctime` (`logging.c:287`):
logfile_fcreated = st.st_ctime; /* not strictly true but close enough */The comment admits the approximation. `st_ctime` changes on *any* inode metadata change (chmod, chown, rename, truncate, `touch -c`), not just content creation. Age-based rotation (`logfile-rotate <max> <MB> <hours>`) therefore measures the interval since the last inode-changing event, which can be reset by an external tool (logrotate `copytruncate`, backup, permission change) and produce an unexpectedly early or late rotation.
Too bad, mucking with the log files in these ways is clearly a Don't Do That. Since POSIX filesystems don't actually record a create time, there's no reliable way to obtain that. Nor is there any valid reason for sysadmins to be doing anything to these files.