Arch Linux

morellik

Member

From: Italy

Registered: 2007-04-05

Posts: 43

syslog-ng and logrotate problem

Dear all,

In my /var/log directory I have a lot of log files. But more are empty, eg:

-rw-r-----  1 root log        0 2007-06-11 00:02 messages.log
-rw-r-----  1 root log        0 2007-06-03 00:02 messages.log.1
-rw-r-----  1 root log        0 2007-05-28 00:02 messages.log.2
-rw-r-----  1 root log        0 2007-05-20 00:02 messages.log.3
-rw-r-----  1 root log   122786 2007-06-13 12:00 messages.log.4

-rw-r-----  1 root log        0 2007-06-11 00:02 syslog.log
-rw-r-----  1 root log        0 2007-06-03 00:02 syslog.log.1
-rw-r-----  1 root log        0 2007-05-28 00:02 syslog.log.2
-rw-r-----  1 root log        0 2007-05-20 00:02 syslog.log.3
-rw-r-----  1 root log  3039330 2007-06-13 12:10 syslog.log.4

Instead of using something.log the system uses something.log.4. Is a syslog-ng or logrotate problem?

Thanks
morellik

luca

Member

From: Rome

Registered: 2005-10-30

Posts: 280

Re: syslog-ng and logrotate problem

Hi morellik,
I think that the problem is logrotate:
this is my /etc/logrotate.d/syslog-ng on my server:

/var/log/messages.log /var/log/auth.log /var/log/mail.log /var/log/kernel.log /var/log/errors.log 
/var/log/daemon.log /var/log/user.log /var/log/iptables.log /var/log/everything.log /var/log/syslog.log  {
missingok
sharedscripts
postrotate
/bin/kill -HUP `cat /var/run/syslog-ng.pid 2>/dev/null`  2> /dev/null || true
endscript
}

cactus

Taco Eater

From: t͈̫̹ͨa͖͕͎̱͈ͨ͆ć̥̖̝o̫̫̼s͈̭̱̞͍̃!̰

Registered: 2004-05-25

Posts: 4,622

Website

Re: syslog-ng and logrotate problem

morellik:
maybe you can paste the contents of your syslog and logrotate configuration files. That might help.

---

"Be conservative in what you send; be liberal in what you accept." -- Postel's Law
"tacos" -- Cactus' Law
"t̥͍͎̪̪͗a̴̻̩͈͚ͨc̠o̩̙͈ͫͅs͙͎̙͊ ͔͇̫̜t͎̳̀a̜̞̗ͩc̗͍͚o̲̯̿s̖̣̤̙͌ ̖̜̈ț̰̫͓ạ̪͖̳c̲͎͕̰̯̃̈o͉ͅs̪ͪ ̜̻̖̜͕" -- -̖͚̫̙̓-̺̠͇ͤ̃ ̜̪̜ͯZ͔̗̭̞ͪA̝͈̙͖̩L͉̠̺͓G̙̞̦͖O̳̗͍

morellik

Member

From: Italy

Registered: 2007-04-05

Posts: 43

Re: syslog-ng and logrotate problem

This is my logrotate.d/syslog-ng

/var/log/messages.log /var/log/auth.log /var/log/mail.log /var/log/kernel.log /var/log/errors.log /var/log/daemon.log /var/log/user.log /var/log/iptables.log /var/log/everything.log /var/log/syslog.log  {
        missingok
        sharedscripts
        postrotate
                /bin/kill -HUP `cat /var/run/syslog-ng.pid 2>/dev/null`  2> /dev/null || true
        endscript
}

And my logrotate.conf

# see "man logrotate" for details
# rotate log files weekly
weekly

# keep 4 weeks worth of backlogs
rotate 4

# create new (empty) log files after rotating old ones
create

# uncomment this if you want your log files compressed
#compress

# Logs are moved into directory for rotation
# olddir /var/log/archive

# Arch packages drop log rotation information into this directory
include /etc/logrotate.d


/var/log/wtmp {
    monthly
    create 0664 root root
    rotate 1
}

Thanks