Re: Logrotate problems

[Florian Kulzer <florian@molphys.leidenuniv.nl>]

On Tue, Aug 15, 2006 at 11:55:38 +0200, Martin wrote:
> Kevin Coyner wrote:
> 
> >Try it as follows:
> >
> >/var/log/mail.log {
> >        weekly
> >        nocompress
> >        rotate 4
> >        missingok
> >        create 640 root adm
> >        postrotate
> >        #reload syslog
> >        /etc/init.d/sysklogd reload
> >        #reload postfix
> >        /etc/init.d/postfix reload
> >        endscript
> >}
> >
> >
> >As I read the man page for logrotate, in one of the examples it has
> >nocompress after endscript just as yours does.  The man explains it
> >by saying the log files will NOT be compressed if an error occurs on
> >more than one file.  I presume your files are not encountering
> >errors, therefore they are compressed because you have the
> >'nocompress' option following the 'endscript' option.
> >
> >Kevin
> 
> Kevin,
> 
> Unfortunately one of my log-files got compressed again, so this didn't 
> work at all.
> 
> I've read something in another NG about sysklogd may be overtaking 
> logrotate. Could this be the solution?
> 
> Do you (or anyone else) know how to check this or to disable this for 
> the particular log in question?

You can run

/usr/sbin/syslogd-listfiles --all

to get a list of all log files that are under the control of sysklogd.

If you want to change the behavior you have to look at

/etc/cron.daily/sysklogd
/etc/cron.weekly/sysklogd

The relevant lines in these two scripts are:

savelog -g adm -m 640 -u root -c 7 $LOG >/dev/null
savelog -g adm -m 640 -u root -c 4 $LOG >/dev/null

Adding the -l option will prevent compression; -c controls how many old
snapshots are kept.

-- 
Regards,
          Florian