Child pages
  • Sysklogd & logrotate
Skip to end of metadata
Go to start of metadata

It is time to clean up the confusing log rotating set-up on our Ubuntu servers.
Currently log rotating is done through syslog and logrotate. We will kill the syslog stuff, and use logrotate for rotating all logs.
Sysklogd will be just another process that needs to have its logs rotated by logrotate.

  1. Generate logrotate config file for sysklogd. You can ask sysklogd what files it is currently logging to, and use that as input for the logrotate config file.
    This one liner will do the trick:
    echo -e "`printf \\"\"%s\\" \" \`syslogd-listfiles -a\`` {\n\tpostrotate\n\tsharedscripts\n\t\t/etc/init.d/sysklogd reload > /dev/null\n\tendscript\n}\n" > /etc/logrotate.d/sysklogd
    
  2. Change according to your needs - defaults are in /etc/logrotate.conf - see man logrotate. Very useful option is dateext. Keep stuff for 5 years:
    weekly
    rotate 260
    dateext
    create
    compress
    delaycompress
    missingok
    include /etc/logrotate.d
    /var/log/wtmp {
            monthly
            rotate 60
            create
    }
    /var/log/btmp {
            monthly
            create
            rotate 60
    }
    
  3. Remove old sysklogd cron entries:
    rm /etc/cron.*/sysklogd
    

This should to the trick. Started testing on Cajones on 2010-01-11.
Also configured on Confluence.

  • No labels

1 Comment

  1. Anonymous

    thanks, had to do this on an aging ubuntu system.

    the snippet above has the sharedscripts/postrotate lines reversed. this works for me:

    echo \-e "`printf \\"\"%s\\" \" \`syslogd-listfiles \-a\`` {\n\tsharedscripts\n\tpostrotate\n\t\t/etc/init.d/sysklogd reload > /dev/null\n\tendscript\n}\n" > /etc/logrotate.d/sysklogd