Re: Strange log-rotate problem
On 2009-08-22 01:08 +0200, Andrew Reid wrote:
> I have a multiply-upgraded Debian "etch" box, which is also a log
> host (i.e. many other hosts log on it via the UDP port that syslog provides),
> and our policies regarding log retention have recently changed.
>
> My problem is that I can't figure out who is rotating /var/log/auth.log.
>
> It's currently being rotated every day, and retained for a week.
>
> I spent a lot of quality time today with the logrotate documentation,
> and I'm confident that it's not in any logrotate scripts.
If you are using sysklogd (the standard syslog daemon in Etch), the
answer is that it uses savelog, not logrotate. See bug #44523¹.
The good news is that in Lenny and later, rsyslog² is the standard
syslog daemon, and it uses logrotate. Of course, upgrading an existing
system will not change your syslog daemon.
There is also an Etch backport of rsyslog, if you would like to use it
without upgrading to Lenny.
¹ http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=44523
² http://packages.debian.org/rsyslog
Reply to: