topic limit and delete daily syslog files in Operating System - Linux

limit and delete daily syslog files

'chris' — Sat, 02 Jul 2005 08:32:49 GMT

hi

I have Debian Sarge Stable and I would like to limit
and delete daily syslog files.

in /etc/logrotate.conf I've created following entries:

/var/log/syslog {
daily
size=100k
missingok
create 0664 root utmp
rotate 1
}

but it seems not to work.

howto restart logrotate to check syntax ?

kind regards
chris

Re: limit and delete daily syslog files

Stuart Browne — Sat, 02 Jul 2005 09:22:38 GMT

What's in '/etc/logrotate.d/baseconf' ?

Re: limit and delete daily syslog files

Stuart Browne — Sat, 02 Jul 2005 09:28:47 GMT

Hrm.. found a debian system, that's not the right file.

'syslog' isn't rotated by 'logrotate' on a debian box.

It's rotated by '/etc/cron.daily/sysklogd'.

There's a line in there that says something like:

savelog -g adm -m 640 -u root -c 7 $LOG >/dev/null

This does pretty much exactally what it reads like.

It saves a log file (i.e. '/var/log/syslog') with group 'adm', owner 'root', permissions 0640, keeping 7 'cycles' worth of log for backup.

'savelog' compresses by default.

So you want only 1 days worth? change the 7 to a 1.

See 'man savelog' for more details, and remove that entry from '/etc/logrotate.conf'.

Re: limit and delete daily syslog files

'chris' — Sat, 02 Jul 2005 10:06:46 GMT

thanks

# vi /etc/logrotate.d/base-config
------------------------------------------------------------------------------------------------
# This is the log file for the installation of debian, and for base-config.
# Useful mainly for post-morten debugging, and if the install went ok, it
# will normally be deleted after one month.
/var/log/base-config.log {
rotate 4
weekly
compress
delaycompress
missingok
nocreate
}
/var/log/base-config.timings {
rotate 4
weekly
compress
delaycompress
missingok
nocreate
}
------------------------------------------------------------------------------------------------

but howto limit these logfiles to 100k ?

Re: limit and delete daily syslog files

Stuart Browne — Sat, 02 Jul 2005 19:51:33 GMT

As the logs only get checked/rotated once a day, then you really can't with the current setup.

'syslogd' doesn't have the ability to limit a logfile's size.

If you really wanted to limit it's size, you'd have to use 'logrotate', and run it far more regularly than daily, but it still wouldn't hit it accurately.

In reality though, why the hell are you trying to limit it to 100kb? That's really not much!

Are you that desperate to save file-system space? But if you're getting that many errors, I'd be more inclined to *FIX* the errors to stop them from getting into the logs! They should really only be 10-15kb a day on a busy system!

If too much is being logged to that file, then restrict what's being written to the file in '/etc/syslog.conf' so you aren't getting double information.

Re: limit and delete daily syslog files

'chris' — Tue, 05 Jul 2005 18:53:41 GMT

sorry, I would like to limit to 2000k

100k is much easier for a test, if it's working or not.

is it not possible to put size 2000k
or something similar to this line:

savelog -g adm -m 640 -u root -c 1 $LOG >/dev/null

in

/etc/cron.daily/sysklogd ?

greetings
chris

Re: limit and delete daily syslog files

Stuart Browne — Tue, 05 Jul 2005 19:07:24 GMT

Nope. Besides, even if you did, it would only check once a day, and as you're already rotating once a day, it's kind of pointless.