Sysklogd Rotation - Debian

This is a discussion on Sysklogd Rotation - Debian ; Dear List, I have added a file to my syslog config for storing local1.log. I now wanted to go about rotating it every day, and storing 32 files (and only this file). After looking at /etc/cron.daily/sysklogd I am starting to ...

+ Reply to Thread
Results 1 to 3 of 3

Thread: Sysklogd Rotation

  1. Sysklogd Rotation

    Dear List,

    I have added a file to my syslog config for storing local1.log. I now
    wanted to go about
    rotating it every day, and storing 32 files (and only this file).

    After looking at /etc/cron.daily/sysklogd I am starting to wonder
    whether this is
    really sensible - or whether I should start looking at syslog-ng?!

    Comments?

    Thanks

    Andrew



    --
    To UNSUBSCRIBE, email to debian-isp-REQUEST@lists.debian.org
    with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

  2. Re: Sysklogd Rotation

    Hi,

    Andrew Miehs a écrit (Wed, Jun 07, 2006 at 06:03:20PM +0200) :
    > I have added a file to my syslog config for storing local1.log. I now
    > wanted to go about
    > rotating it every day, and storing 32 files (and only this file).
    >
    > After looking at /etc/cron.daily/sysklogd I am starting to wonder
    > whether this is
    > really sensible - or whether I should start looking at syslog-ng?!


    I feel that sysklogd in Debian is recurrently critized.

    I admit that it was not straigtforward for me to understand.

    In short :

    'syslogd-listfiles' lists the daily rotated files
    'syslogd-listfiles --auth' the weekly ones

    It is possible to tell sysklog to ignore files for rotation with the
    '-s' option of 'syslogd-listfiles'. For example, to ignore 'mail.*' :

    # cp -p /etc/cron.weekly/sysklogd{,.orig}
    # vi /etc/cron.weekly/sysklogd
    # diff /etc/cron.weekly/sysklogd{.orig,}
    29c29
    < for LOG in `syslogd-listfiles --weekly`
    ---

    > for LOG in `syslogd-listfiles --weekly -s "mail.*"`


    You can then use logrotate :

    /etc/logrotate.d/maillogs :

    /var/log/mail.log /var/log/mail.info /var/log/mail.warn /var/log/mail.err {
    daily
    rotate 365
    compress
    create 640 root adm
    postrotate
    /etc/init.d/sysklogd reload-or-restart > /dev/null
    endscript
    }

    Yes, not straightforward ;-)

    PS : I think I reused some material posted on this list by Stéphane
    Bortzmeyer.


    HTH,

    --
    Emmanuel Halbwachs
    Resp. Réseau/Sécurité Observatoire de Paris-Meudon
    tel : (+33)1 45 07 75 54 5 Place Jules Janssen
    fax : (+33)1 45 07 76 13 F 92195 MEUDON CEDEX


    --
    To UNSUBSCRIBE, email to debian-isp-REQUEST@lists.debian.org
    with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

  3. Re: Sysklogd Rotation

    Andrew Miehs wrote:
    > Dear List,
    >
    > I have added a file to my syslog config for storing local1.log. I now
    > wanted to go about
    > rotating it every day, and storing 32 files (and only this file).
    >
    > After looking at /etc/cron.daily/sysklogd I am starting to wonder
    > whether this is
    > really sensible - or whether I should start looking at syslog-ng?!


    You can do what you want with sysklogd. The default, however, is to
    not rotate log files on a daily basis unless then grow too large.
    However, adding the "-s pattern" commandline to the execution of
    syslogd-listfiles you can filter out the files you want to handle
    separately. Don't forget to actualy handle them separately.

    Regards,

    Joey

    --
    Have you ever noticed that "General Public Licence" contains the word "Pub"?

    Please always Cc to me when replying to me on the lists.


    --
    To UNSUBSCRIBE, email to debian-isp-REQUEST@lists.debian.org
    with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

+ Reply to Thread