Re: Selective rotation of journald logs

[Mariusz Gronczewski <xani@devrandom.pl>]

Dnia 2024-02-23, o godz. 11:15:29
Nicolas George <george@nsup.org> napisał(a):

> Hi.
> 
> It might be an obvious question, but I do not manage to find the
> obvious answer:
> 
> How do I tell systemd's logging system to keep authentication logs for
> one year and mail logs for one month?
> 
> Regards,
> 

That is not a feature systemd's logging have. You'd have to make a
rsyslogd rule to put it in one directory, another one for the other use
then tweak logrotate rules to rotate and keep each of them for
different length.

Most packages already log to separate files and have separate logrotate
rules so often it is just changing a single line, for example auth.log
is rotated with rest of the default logs:

/var/log/syslog
/var/log/mail.log
/var/log/kern.log
/var/log/auth.log
/var/log/user.log
/var/log/cron.log
{
	rotate 4
	weekly
	missingok
	notifempty
	compress
	delaycompress
	sharedscripts
	postrotate
		/usr/lib/rsyslog/rsyslog-rotate
	endscript
}

so if you wanted to change only auth.log you'd copy the section, and remove it from current one, like this:


/var/log/auth.log
{
	rotate 53 # a year in weeks
	weekly
	missingok
	notifempty
	compress
	delaycompress
	sharedscripts
	postrotate
		/usr/lib/rsyslog/rsyslog-rotate
	endscript
}


-- 
Mariusz Gronczewski (XANi) <xani666@gmail.com>
GnuPG: 0xEA8ACE64
https://devrandom.eu