Thanks to everyone who responded. The consensus is that syslogd uses a 24
hour alarm clock, starting at either boot time or SIGHUP signal receipt.
This time may vary a bit because the alarm feature (probably SIGARLM) is not
guaranteed to be processed at the exact time it goes off (matter of fact,
it's not even guaranteed to go off at exactly the time you wish it) -- system
load can contribute to it being off a bit.
What I wanted to do was process the log entries in there right before the
switch (only way to look at all appropriate log files without major risk of
not processing some lines). That's basically impossible, so I'll just have
to redirect anything I want to process in a coordinated fashion to another
location, where I control its pruning.
------------------------------------------------------------------------------
Mike Matthews, Mike_Matthews_at_sgate.com (NeXTmail accepted)
Received on Fri Jul 07 1995 - 19:23:50 NZST