<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.6000.16981" name=GENERATOR></HEAD>
<BODY>
<DIV dir=ltr align=left><SPAN class=828305120-16022010><FONT face=Arial
color=#0000ff size=2>Tom -</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=828305120-16022010><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=828305120-16022010><FONT face=Arial
color=#0000ff size=2>If the only thing you're doing is replacing syslog with
syslog-ng, then the only thing you'll have to change is the restart line in
/etc/logrotate.d/syslog:</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=828305120-16022010><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=828305120-16022010><FONT face=Arial
color=#0000ff size=2> postrotate
<BR> /etc/init.d/syslog-ng
restart</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=828305120-16022010><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=828305120-16022010><FONT face=Arial
color=#0000ff size=2>Of course, if that's all you're doing - why bother?
:)</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=828305120-16022010><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=828305120-16022010><FONT face=Arial
color=#0000ff size=2>But basically, they're the same. I'm using syslog-ng
on our RHEL5 servers to split the logs up better, so that, for instance, they're
not all going to daemon.log. snmp to snmp.log, iptables stuff to various
firewall-*.log, etc. So mine looks like this:</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=828305120-16022010><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=828305120-16022010><FONT face=Arial
color=#0000ff
size=2>/var/log/servername.log<BR>/var/log/firewall*.log<BR>/var/log/snmp.log<BR>/var/log/auth.log<BR>/var/log/daemon.log<BR>/var/log/kern.log<BR>/var/log/lpr.log
<BR>/var/log/mail.log<BR>/var/log/boot.log {<BR>
missingok<BR> sharedscripts<BR>
compress<BR> postrotate<BR>
/etc/init.d/syslog-ng restart<BR>
endscript<BR>}<BR></FONT></SPAN><BR></DIV>
<BLOCKQUOTE
style="PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #0000ff 2px solid; MARGIN-RIGHT: 0px">
<DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left>
<HR tabIndex=-1>
<FONT face=Tahoma size=2><B>From:</B> syslog-ng-bounces@lists.balabit.hu
[mailto:syslog-ng-bounces@lists.balabit.hu] <B>On Behalf Of </B>Tom
Simons<BR><B>Sent:</B> Monday, February 15, 2010 6:51 PM<BR><B>To:</B>
syslog-ng@lists.balabit.hu<BR><B>Subject:</B> [syslog-ng] syslog-ng with
logrotate<BR></FONT><BR></DIV>
<DIV></DIV>We're replacing sysklogd on our RHEL4 & 5 servers with
syslog-ng-premium-edition 3.0.4-1. <SPAN class=gI><BR><BR>Has anyone
configured logrotate to work with syslog-ng? Can we just build
/etc/logrotate.d/syslog-ng from </SPAN><SPAN
class=gI>/etc/logrotate.d/syslog?</SPAN> </BLOCKQUOTE></BODY></HTML>