5

OS: Running RHEL 5.6.

Situation: I need to rotate /var/log/messagees on a different schedule than the rest of the syslog logs.

By default syslog logs are rotated weekly based on the /etc/logrotate.conf and /etc/logrotate.d/syslog configuration files.

If you look at /etc/logrotate.d/syslog you will find that there is one logrotate configuration block for all of the logs. If I want /var/log/messages to rotate on a different schedule I need to create a separate configuration block for it. This would result in restarting syslogd twice (based on copying the existing config).

Question: Is there a way to rotate /var/log/messages on a different schedule than the other syslog logs without having to send HUP to syslogd twice? Or does this even matter? What is the best practice here?

Joshua
  • 53
  • 1
  • 3
  • 3
    I believe the only thing HUP signal does it tell syslog to close, and re-open the log files. I can't imagine this would be a huge problem unless you an extremely active system. – Zoredache May 22 '12 at 23:38

1 Answers1

2

Set up a separate block for the messages log in /etc/logrotate.d/rsyslog (or whatever it's called on your install). It should use the setting for the specific log file match preferentially to a general one.

No, as Zoredache mentioned, multiple HUPs shouldn't break anything unless you're really hammering rsyslog anyway.

Magellan
  • 4,451
  • 3
  • 30
  • 53
  • Thanks guys, the system is not too busy. I will impalement this. I couldn't think of a reason not to, wanted to see if anyone saw any negatives in doing things this way. – Joshua May 23 '12 at 23:43
  • If you think the answer fits your question, please make sure you accept and/or upvote the answers. You're more likely to get folks to answer your future questions if you have a high percentage of accepted answers. – Magellan May 24 '12 at 00:10