2

It seems that my logfiles generated by syslog are getting rotated twice each day. I believe this is due to both /etc/cron.daily/logrotate and /etc/cron.daily/sysklogd doing overlapping work.

Here are the relevant lines from the sysklogd script:

logs=$(syslogd-listfiles)

test -n "$logs" || exit 0

for LOG in $logs
do
   if [ -s $LOG ]; then
      savelog -g adm -m 640 -u ${USER} -c 7 $LOG >/dev/null
   fi
done

What are the best common practices for dealing with this? Should files generated by syslog not be listed in logrotate? What if I want to use some of logrotate's more advanced features, like postrotate scripts -- should I try to make /etc/cron.daily/sysklogd do it, or should I comment out those lines and let logrotate do it?

mike
  • 3,963
  • 11
  • 30
  • 27

2 Answers2

2

I was very annoyed when sysklogd started doing log rotation -- it's not as though it was a missing feature that didn't exist elsewhere. On my systems, though, logrotate isn't configured to do anything with the system logs -- is that something that you configured manually?

To maintain the principle of least surprise, I leave sysklogd to rotate it's own logs (on the basis that, if someone else needs to maintain one of my systems, it's better if they get default behaviour wherever possible), but if you wanted logrotate's advanced features, I'd turn off the sysklogd cron job, comment a pointer to the correct place, and go logrotate wild.

womble
  • 96,255
  • 29
  • 175
  • 230
0

What distribution?

If you run "syslogd-listfiles", are any of the files outputted in that list also managed via a file in /etc/logrotate.d/?

Looking on my Ubuntu box, /etc/cron.daily/sysklogd doesn't actually ever do anything because /usr/sbin/syslogd-listfiles doesn't exist.

freiheit
  • 14,544
  • 1
  • 47
  • 69