limit and delete daily syslog files

['chris']

hi

I have Debian Sarge Stable and I would like to limit
and delete daily syslog files.

in /etc/logrotate.conf I've created following entries:

/var/log/syslog {
daily
size=100k
missingok
create 0664 root utmp
rotate 1
}

but it seems not to work.

howto restart logrotate to check syntax ?

kind regards
chris

[Stuart Browne]

What's in '/etc/logrotate.d/baseconf' ?

[Stuart Browne · Accepted solution]

Hrm.. found a debian system, that's not the right file.

'syslog' isn't rotated by 'logrotate' on a debian box.

It's rotated by '/etc/cron.daily/sysklogd'.

There's a line in there that says something like:

savelog -g adm -m 640 -u root -c 7 $LOG >/dev/null

This does pretty much exactally what it reads like.

It saves a log file (i.e. '/var/log/syslog') with group 'adm', owner 'root', permissions 0640, keeping 7 'cycles' worth of log for backup.

'savelog' compresses by default.

So you want only 1 days worth? change the 7 to a 1.

See 'man savelog' for more details, and remove that entry from '/etc/logrotate.conf'.

['chris']

thanks

# vi /etc/logrotate.d/base-config
------------------------------------------------------------------------------------------------
# This is the log file for the installation of debian, and for base-config.
# Useful mainly for post-morten debugging, and if the install went ok, it
# will normally be deleted after one month.
/var/log/base-config.log {
rotate 4
weekly
compress
delaycompress
missingok
nocreate
}
/var/log/base-config.timings {
rotate 4
weekly
compress
delaycompress
missingok
nocreate
}
------------------------------------------------------------------------------------------------

but howto limit these logfiles to 100k ?

[Stuart Browne]

As the logs only get checked/rotated once a day, then you really can't with the current setup.

'syslogd' doesn't have the ability to limit a logfile's size.

If you really wanted to limit it's size, you'd have to use 'logrotate', and run it far more regularly than daily, but it still wouldn't hit it accurately.

In reality though, why the hell are you trying to limit it to 100kb? That's really not much!

Are you that desperate to save file-system space? But if you're getting that many errors, I'd be more inclined to *FIX* the errors to stop them from getting into the logs! They should really only be 10-15kb a day on a busy system!

If too much is being logged to that file, then restrict what's being written to the file in '/etc/syslog.conf' so you aren't getting double information.

['chris']

sorry, I would like to limit to 2000k

100k is much easier for a test, if it's working or not.

is it not possible to put size 2000k
or something similar to this line:

savelog -g adm -m 640 -u root -c 1 $LOG >/dev/null

in

/etc/cron.daily/sysklogd ?

greetings
chris

[Stuart Browne]

Nope. Besides, even if you did, it would only check once a day, and as you're already rotating once a day, it's kind of pointless.