We're replacing sysklogd on our RHEL4 & 5 servers with syslog-ng-premium-edition 3.0.4-1. Has anyone configured logrotate to work with syslog-ng? Can we just build /etc/logrotate.d/syslog-ng from /etc/logrotate.d/syslog?
Hey Tom, I don't have a RHEL init script handy, but you may want to take a look inside it to see if /etc/init.d/syslog-ng for 3.0.4 creates a link /var/run/syslogd.pid file to syslog-ng's pid upon starting. This way, the default logrotate does a HUP on syslog(-ng)'s PID with no change necessary to your logrotate configuration. This is of course assuming your /etc/logrotate.d/syslog configuration does a HUP on /var/run/syslogd.pid (which looks to be the default for CentOS 5.4). If it's calling an init script or service reload, you may want to symlink /etc/init.d/syslog to /etc/init.d/syslog-ng, or you could just do as you originally planned and generate an /etc/logrotate.d/syslog-ng file. To anyone else reading this thread who is using ubuntu 8.04 (and probably other debian releases), logrotate still exists, but log rotation for files such as /var/log/syslog is executed via Cron. Have a look at /etc/cron.daily/sysklogd and you will see a shell script that runs the syslogd-listfiles binary in order to get a list of files that it rotates in that daily cron job. As such, if you're running ubuntu you may have to generate your own logrotate.d/files after your upgrade to syslog-ng (I could be wrong on this though, as I am using my own packaging). Something like this should work: #cat /etc/logrotate.d/syslog-ng /var/log/syslog { weekly missingok compress create 600 root root rotate 8 sharedscripts postrotate if [ -f /var/run/syslog-ng.pid ]; then \ kill -HUP `cat /var/run/syslog-ng.pid`; \ fi; endscript } On Mon, Feb 15, 2010 at 3:51 PM, Tom Simons <tom.simons@gmail.com> wrote:
We're replacing sysklogd on our RHEL4 & 5 servers with syslog-ng-premium-edition 3.0.4-1.
Has anyone configured logrotate to work with syslog-ng? Can we just build /etc/logrotate.d/syslog-ng from /etc/logrotate.d/syslog? ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html
-- Lance Laursen Demonware Systems Engineer
Tom - If the only thing you're doing is replacing syslog with syslog-ng, then the only thing you'll have to change is the restart line in /etc/logrotate.d/syslog: postrotate /etc/init.d/syslog-ng restart Of course, if that's all you're doing - why bother? :) But basically, they're the same. I'm using syslog-ng on our RHEL5 servers to split the logs up better, so that, for instance, they're not all going to daemon.log. snmp to snmp.log, iptables stuff to various firewall-*.log, etc. So mine looks like this: /var/log/servername.log /var/log/firewall*.log /var/log/snmp.log /var/log/auth.log /var/log/daemon.log /var/log/kern.log /var/log/lpr.log /var/log/mail.log /var/log/boot.log { missingok sharedscripts compress postrotate /etc/init.d/syslog-ng restart endscript } _____ From: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Tom Simons Sent: Monday, February 15, 2010 6:51 PM To: syslog-ng@lists.balabit.hu Subject: [syslog-ng] syslog-ng with logrotate We're replacing sysklogd on our RHEL4 & 5 servers with syslog-ng-premium-edition 3.0.4-1. Has anyone configured logrotate to work with syslog-ng? Can we just build /etc/logrotate.d/syslog-ng from /etc/logrotate.d/syslog?
participants (3)
-
Lance Laursen
-
Tim Boyer
-
Tom Simons