1

The default directory in which the OS writes its logs is '/var/log/', I want to change that directory to another one that I create. How can I do that?

Note:

I tried changing the paths (/var/log/.) to (/var/tmp_log/.) in '/etc/rsyslog.conf', created the destination folder '/tmp_log/' and rebooted my PC but it just stopped writing new logs.

then tried to copy the original files from '/var/log/' to '/var/tmp_log/' and it didn't work either.

  • 1
    Did you properly configure SELinux to allo rsyglog write into the new log directory? – mvillar May 19 '15 at 11:41
  • Why do you want to do this? – Michael Hampton May 19 '15 at 14:52
  • I only need to change the logging path for access logs and ssh – Muhmmad Aziz May 19 '15 at 16:42
2

Have you also checked all other files inside /etc/rsyslog.d/ ?

/var/log is the default log folder for many other applications that don't necessarily depend on rsyslog. Apache for example doesn't use rsyslog so you'll have to change the config file of every application that writes to /var/log.

lsof +D /var/log/ will give you all processes that have open files inside that folder. Please note that this will only show processes that have the file OPEN. Some applications don't keep the file open all the time and only write to the logs in batches.

Another options would be to create your new folder /var/tmp_log/ and create a a symlink on /var/log pointing to it. Would that work ?

  • I checked the /etc/rsyslog/ path it had one file inside and didn't contain any thing useful. and the lsof command didn't work!! – Muhmmad Aziz May 19 '15 at 16:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.