Re: How do I change which logfiles are rotated when?

["Marc-Adrian Napoli" <marcadrian@cia.com.au>]

HI all,

>Look in /etc/cron.daily/ and /etc/cron.weekly/ for the invocation
>of syslogd-listfiles, and the rotation frequency.

>>Hi,
>>    The logfile rotation stuff makes use of syslogd-listfiles, which
>>claims in its man page to be controlled by /etc/syslog.conf
>>Unfortunately, I can't find anything in man syslog.conf, or the file
>>itself that mentions what it is about an entry in /etc/syslog.conf
>>that flags it as requiring a certain frequency of rotation.

Just reading over this, I want to share what i have done, and see if anyone
else is doing the same.

Look at the /etc/cron.daily/sysklogd and /etc/cron.weekly/sysklogd files.

The way debian rotates logs is a little tricky.

I have edited my syslog.conf file to do the following:

syslog.*                        -/var/log/syslog
daemon.*                        -/var/log/daemon.log
kern.*                          -/var/log/kern.log
user.*                          -/var/log/user.log
#mail.*                         -/var/log/mail.log
#news.*                         -/var/log/news.log
#uucp.*                         -/var/log/uucp.log
#cron.*                         -/var/log/cron.log
#lpr.*                          -/var/log/lpr.log

Comment\uncomment these out at will.

This way... each facility is being logged to its own file. Then you can
decide which ones you want rotated daily, and which ones you want rotated
weekly.

ie. in my /etc/cron.daily/sysklogd file i have the following:

savelog -u root -g adm -m 640 -c 7 /var/log/auth.log >/dev/null
savelog -u root -g adm -m 640 -c 7 /var/log/lastlog >/dev/null

and in my /etc/cron.weekly/sysklogd file i have the following:

savelog -g -adm -m 640 -u root -c 4 /var/log/syslog >/dev/null
savelog -g -adm -m 640 -u root -c 4 /var/log/daemon.log >/dev/null
savelog -g -adm -m 640 -u root -c 4 /var/log/kern.log >/dev/null
savelog -g -adm -m 640 -u root -c 4 /var/log/user.log >/dev/null


I basically commented out the little if/then loop that uses the
sysklogd-listfiles command to see which log files to rotate.. it doens't
work too well because you can only specify either --all, --auth,
or --weekly.

If you need more control (like i did) then you have to put the savelog
commands in manually.

Regards,

Marc-Adrian Napoli
Connect Infobahn Australia
+61 2 92811750