I saw some discussion on a similar subject on the list a while back, but
I don't think it dealt with this specifically.
I run logrotate nightly, and it executes '/usr/bin/killall -HUP
syslog-ng' after rotating the logs. After that, I get no more logging
from the kernel until I manually restart syslog-ng ('service syslog-ng
restart').
I realize I could ditch klogd and use syslog-ng exclusively, but I'm
reluctant to drop support for kernel symbols.
Any insights?
Paul
__________________________
Versions:
syslog-ng 1.6.0rc1 (also seen with 1.5.26)
klogd 1.4.1
linux kernel 2.4.18-15clx (Celestix distro, mandrake-based)
killall (psmisc v19)
__________________________
Here's my syslog-ng.conf. I've tried the unix-dgram statement with and
without 'keep-alive(yes) max-connections(512)' just to be sure (I don't
think those options apply to unix-dgram?). I'll be changing the 'logall'
target to feed logsurfer, once I've got that working the way I'd like.
# syslog-ng configuration file.
#
# See syslog-ng(8) and syslog-ng.conf(5) for more information.
#
options { sync (0);
time_reopen (10);
log_fifo_size (1000);
long_hostnames (off);
use_dns (no);
use_fqdn (no);
create_dirs (no);
keep_hostname (yes);
};
source sys { unix-dgram ("/dev/log" keep-alive(yes)
max-connections(512)); internal(); };
source remote { udp(); };
destination auth { file("/var/log/auth.log"); };
destination syslog { file("/var/log/syslog"); };
destination user { file("/var/log/user.log"); };
destination mesg { file("/var/log/messages"); };
destination secure { file("/var/log/secure"); };
destination mailinfo { file("/var/log/mail/info"); };
destination mailwarn { file("/var/log/mail/warnings"); };
destination mailerr { file("/var/log/mail/errors"); };
destination croninfo { file("/var/log/cron/info"); };
destination cronwarn { file("/var/log/cron/warnings"); };
destination cronerr { file("/var/log/cron/error"); };
destination kerninfo { file("/var/log/kernel/info"); };
destination kernwarn { file("/var/log/kernel/warnings"); };
destination kernerr { file("/var/log/kernel/error"); };
destination lprinfo { file("/var/log/lpr/info"); };
destination lprwarn { file("/var/log/lpr/warnings"); };
destination lprerr { file("/var/log/lpr/error"); };
destination newsinfo { file("/var/log/news/info"); };
destination newswarn { file("/var/log/news/warnings"); };
destination newserr { file("/var/log/news/error"); };
destination daemoninfo { file("/var/log/daemons/info"); };
destination daemonwarn { file("/var/log/daemons/warnings"); };
destination daemonerr { file("/var/log/daemons/errors"); };
destination spool { file("/var/log/spooler"); };
destination boot { file("/var/log/boot.log"); };
destination logall { file("/var/log/everything.log"); };
destination mailall { usertty("*"); };
# Generic filters
filter f_info { level(debug,info,notice); };
filter f_warn { level(warn); };
filter f_error { level(error); };
filter f_emergency { level(emerg); };
filter f_mail { facility(mail); };
filter f_cron { facility(cron); };
filter f_kernel { facility(kern); };
filter f_lpr { facility(lpr); };
filter f_news { facility(news); };
filter f_daemon { facility(daemon); };
# Specific filters
filter f_authonly { facility(auth,authpriv); };
filter f_user { facility(user); };
# Log anything (except mail) of level info or higher
# Don't log private authentication messages
filter f_mesgs { level(info..warn) and not
facility(mail,authpriv); };
# authpriv logging (restricted)
filter f_secure { facility(authpriv); };
filter f_spool { facility(uucp) or (facility(news) and
level(crit)); };
filter f_boot { facility(local7); };
filter f_syslog { not facility(auth, authpriv); };
# Log to logfiles
log { source(sys); destination(logall); };
log { source(sys); filter(f_spool); destination(spool); };
log { source(sys); filter(f_boot); destination(boot); };
log { source(sys); filter(f_user); destination(user); };
log { source(sys); filter(f_secure); destination(secure); };
log { source(sys); filter(f_syslog); destination(syslog); };
log { source(sys); filter(f_mesgs); destination(mesg); };
log { source(sys); filter(f_authonly); destination(auth); };
log { source(sys); filter(f_mail); filter(f_info);
destination(mailinfo); };
log { source(sys); filter(f_mail); filter(f_warn);
destination(mailwarn); };
log { source(sys); filter(f_mail); filter(f_error);
destination(mailerr); };
log { source(sys); filter(f_cron); filter(f_info);
destination(croninfo); };
log { source(sys); filter(f_cron); filter(f_warn);
destination(cronwarn); };
log { source(sys); filter(f_cron); filter(f_error);
destination(cronerr); };
log { source(sys); filter(f_kernel); filter(f_info);
destination(kerninfo); };
log { source(sys); filter(f_kernel); filter(f_warn);
destination(kernwarn); };
log { source(sys); filter(f_kernel); filter(f_error);
destination(kernerr); };
log { source(sys); filter(f_lpr); filter(f_info); destination(lprinfo);
};
log { source(sys); filter(f_lpr); filter(f_warn); destination(lprwarn);
};
log { source(sys); filter(f_lpr); filter(f_error); destination(lprerr);
};
log { source(sys); filter(f_news); filter(f_info);
destination(newsinfo); };
log { source(sys); filter(f_news); filter(f_warn);
destination(newswarn); };
log { source(sys); filter(f_news); filter(f_error);
destination(newserr); };
log { source(sys); filter(f_daemon); filter(f_info);
destination(daemoninfo); };
log { source(sys); filter(f_daemon); filter(f_warn);
destination(daemonwarn); };
log { source(sys); filter(f_daemon); filter(f_error);
destination(daemonerr); };
# Log to console
log { source(sys); filter(f_emergency); destination(mailall); };
__________________________
Here's my logrotate.conf:
# see "man logrotate" for details
# rotate log files weekly
weekly
# keep 4 weeks worth of backlogs
rotate 4
# send errors to root
errors root
# create new (empty) log files after rotating old ones
create
# uncomment this if you want your log files compressed
compress
# don't archive if the log is empty
notifempty
# RPM packages drop log rotation information into this directory
include /etc/logrotate.d
# no packages own wtmp -- we'll rotate it here
/var/log/wtmp {
monthly
create 0664 root utmp
rotate 1
}
# system-specific logs may be configured here
# catchall that will rotate anything with the normal naming convention
/var/log/*log {
weekly
notifempty
sharedscripts
prerotate
/usr/local/etc/logcheck.sh
endscript
postrotate
/usr/bin/killall -HUP syslog-ng
endscript
}