Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

It seems that my logfiles generated by syslog are getting rotated twice each day. I believe this is due to both /etc/cron.daily/logrotate and /etc/cron.daily/sysklogd doing overlapping work.

Here are the relevant lines from the sysklogd script:

logs=$(syslogd-listfiles)

test -n "$logs" || exit 0

for LOG in $logs
do
   if [ -s $LOG ]; then
      savelog -g adm -m 640 -u ${USER} -c 7 $LOG >/dev/null
   fi
done

What are the best common practices for dealing with this? Should files generated by syslog not be listed in logrotate? What if I want to use some of logrotate's more advanced features, like postrotate scripts -- should I try to make /etc/cron.daily/sysklogd do it, or should I comment out those lines and let logrotate do it?

share|improve this question

2 Answers 2

I was very annoyed when sysklogd started doing log rotation -- it's not as though it was a missing feature that didn't exist elsewhere. On my systems, though, logrotate isn't configured to do anything with the system logs -- is that something that you configured manually?

To maintain the principle of least surprise, I leave sysklogd to rotate it's own logs (on the basis that, if someone else needs to maintain one of my systems, it's better if they get default behaviour wherever possible), but if you wanted logrotate's advanced features, I'd turn off the sysklogd cron job, comment a pointer to the correct place, and go logrotate wild.

share|improve this answer

What distribution?

If you run "syslogd-listfiles", are any of the files outputted in that list also managed via a file in /etc/logrotate.d/?

Looking on my Ubuntu box, /etc/cron.daily/sysklogd doesn't actually ever do anything because /usr/sbin/syslogd-listfiles doesn't exist.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.