Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm running CentOS6 and I configured rsyslog to monitor my iptables warning messages and dump them in /var/log/iptables.log. I went through my logrotate.d/syslog file and added iptables.log so logrotate would pick up and rotate the logs. The file looks like this:

/var/log/cron
/var/log/maillog
/var/log/messages
/var/log/secure
/var/log/spooler
/var/log/iptables.log
{
    sharedscripts
    postrotate
        /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
    endscript
}

However, when I run logrotate -f -v logrotate.conf to trigger a force roll, the iptables.log file doesn't roll. To make logrotate not barf on the iptables file, I created a iptables.log-20121014 file.

My output when I run the command looks like this:

rotating log /var/log/iptables.log, log->rotateCount is 4
dateext suffix '-20121021'

I'm flummoxed. How do I get logrotate to roll the file? I'm not 100% sure if I configured it correctly, but I don't know enough to be certain if that's the case.

share|improve this question

1 Answer 1

up vote 2 down vote accepted

I believe a more effective solution would be to actually create a specific logrotate instance for iptables instead of adding it directly to your syslog logrotate instance.

Do this by:

$ touch /etc/logrotate.d/iptables

Now, configure the logrotation as you'd like, an example would be the following (You may find all options HERE (logrotate.conf):

$ vi iptables
/var/log/iptables.log {
missingok
notifempty
size 30k
create 0600 root root
postrotate
    /etc/rc.d/init.d/rsyslog restart ; sleep 5
endscript
}

This should provide the functionality you're searching for.

share|improve this answer
    
Thanks! That did exactly what I needed it to. Appreciate the helpful explanation! –  FloppyDisk Oct 24 '12 at 15:37
    
You're quite welcome! –  RWC Oct 24 '12 at 20:35
    
Restarting rsyslog after creating a new logrotate directive is unnecessary since logrotate is separate from rsyslog and called via cron. Also, invoke-rc.d appears not to work on CentOS 6. –  reflexiv Jul 19 at 0:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.