Re: Sysklogd Rotation

[Emmanuel Halbwachs <Emmanuel.Halbwachs@obspm.fr>]

Hi,

Andrew Miehs a écrit (Wed, Jun 07, 2006 at 06:03:20PM +0200) :
> I have added a file to my syslog config for storing local1.log. I now  
> wanted to go about
> rotating it every day, and storing 32 files (and only this file).
> 
> After looking at /etc/cron.daily/sysklogd I am starting to wonder  
> whether this is
> really sensible - or whether I should start looking at syslog-ng?!

I feel that sysklogd in Debian is recurrently critized.

I admit that it was not straigtforward for me to understand.

In short :

'syslogd-listfiles' lists the daily rotated files
'syslogd-listfiles --auth' the weekly ones

It is possible to tell sysklog to ignore files for rotation with the
'-s' option of 'syslogd-listfiles'. For example, to ignore 'mail.*' :

# cp -p /etc/cron.weekly/sysklogd{,.orig}
# vi /etc/cron.weekly/sysklogd
# diff /etc/cron.weekly/sysklogd{.orig,}
29c29
< for LOG in `syslogd-listfiles --weekly`
---

> for LOG in `syslogd-listfiles --weekly -s "mail.*"`

You can then use logrotate :

    /etc/logrotate.d/maillogs :

    /var/log/mail.log /var/log/mail.info /var/log/mail.warn /var/log/mail.err {
            daily
            rotate 365
            compress
            create 640 root adm
            postrotate
                  /etc/init.d/sysklogd reload-or-restart > /dev/null
            endscript
    }

Yes, not straightforward ;-)

PS : I think I reused some material posted on this list by Stéphane
Bortzmeyer.


HTH,

-- 
Emmanuel Halbwachs
Resp. Réseau/Sécurité                    Observatoire de Paris-Meudon
tel      : (+33)1 45 07 75 54                   5 Place Jules Janssen
fax      : (+33)1 45 07 76 13                    F 92195 MEUDON CEDEX