On Sun 06 Apr 2008, Michael Biebl wrote:
>
> I considered your suggestions and merged all daily rotated log files
> (and added missingok, notifempty, delaycompress and sharedscripts).
>
> The resulting file is attached as rsyslog.logrotate.
> I see the following problems:
> 1.) The file has become less readable because of the long line
A quick test seems to show that logrotate doesn't mind if the list of
files is split over more than one line.
> 2.) It becomes harder to change the configuration for a single log file
> (e.g. if the administrator wants to keep 8 log files of mail.log) as all
> weekly and daily entries are merged into a single configuration stanza.
You could put each file on its own line...
> 3.) There is one day during the week, where rsyslog is reloaded twice.
I think that we have to live with this...
Alternatively you could create a separate rsyslog cron.daily script that
reloads rsyslog, and then don't do the reloading within logrotate.
> An alternative file layout is the one of syslog-ng, where all log files
> have a separate config stanza (attached as syslog-ng.logrotate).
> This approach has imho the following problems
> 1.) It's more cumbersome to change the configuration for all log files
> (e.g. from compress to nocompress), as you now have to edit 14 different
> stanzas
I don't like that either :-(
> 2.) Having a single postrotate script tied to /var/log/syslog could lead
> to the case, where /var/log/syslog hasn't changed (even if that is
> probably unlikely) but others have (such as mail.*).
This could be solved by doing a separate reload in a separate script,
as I described above.
> /var/log/mail.err /var/log/mail.info /var/log/mail.log /var/log/mail.warn
> /var/log/auth.log /var/log/user.log /var/log/messages /var/log/debug
> /var/log/lpr.log {
> rotate 4
> weekly
> missingok
> notifempty
> compress
> delaycompress
> sharedscripts
> postrotate
> invoke-rc.d rsyslog reload > /dev/null
> endscript
> }
This could become:
/var/log/mail.err
/var/log/mail.info
/var/log/mail.log
/var/log/mail.warn
/var/log/auth.log
/var/log/user.log
/var/log/messages
/var/log/debug
/var/log/lpr.log
{
rotate 4
weekly
missingok
notifempty
compress
delaycompress
sharedscripts
postrotate
invoke-rc.d rsyslog reload > /dev/null
endscript
}
Not so very readable either, but preferable to having duplicated stanzas
for each file.
Perhaps double-check with the logrotate maintainer whether this syntax
is supported, even though it works now. It would suck if it suddenly
stopped working...
Paul Slootman
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
