Re: Logrotate problems

[Florian Kulzer <florian@molphys.leidenuniv.nl>]

On Tue, Aug 15, 2006 at 14:14:28 +0200, Martin wrote:
> Florian Kulzer wrote:
> 
> >You can run
> >
> >/usr/sbin/syslogd-listfiles --all
> >
> >to get a list of all log files that are under the control of sysklogd.
> >
> >If you want to change the behavior you have to look at
> >
> >/etc/cron.daily/sysklogd
> >/etc/cron.weekly/sysklogd
> >
> >The relevant lines in these two scripts are:
> >
> >savelog -g adm -m 640 -u root -c 7 $LOG >/dev/null
> >savelog -g adm -m 640 -u root -c 4 $LOG >/dev/null
> >
> >Adding the -l option will prevent compression; -c controls how many old
> >snapshots are kept.
> 
> Florian,
> 
> Thanks! With the listfiles-command i can see that mail.log is under 
> control by sysklogd.
> 
> I can see the corresponding lines in cron.daily(and weekly)/sysklogd.
> 
> My question: How do i exclude mail.log from sysklogd?
> 
> Is there a reason to run sysklogd instead of logrotate? Seems rather 
> pointless to have both?

I think the point is to have sysklogd take care of all the important
system logs entirely. logrotate takes care of "the rest" and therefore
has to be configurable (by putting files into /etc/logrotate.d/) which
might make it more difficult to make it secure. Also, someone running
linux on very limited hardware will like the option of not installing
logrotate at all and nevertheless have the important log files taken
care of.

Unfortunately I don't know of a simple way to make sysklogd leave some
of its log files alone when its savelog commands are run. You could
try to comment out the "mail." lines in /etc/syslog.conf, but I am
pretty sure that this will mean that you lose the mail logs entirely.
The only feasible approach seems to be to edit the cron.daily/weekly
scripts so that they leave mail.log alone.

-- 
Regards,
          Florian