Hi,
I setted up my workstation
to logrotate logs based on size.
thoses entries are in /etc/logrotate.d/syslog-ng :
[...]
/var/log/ppp.log {
rotate 20
size=10M
missingok
notifempty
compress
}
[...]
/var/log/syslog {
rotate 20
size=10M
compress
postrotate
/etc/init.d/syslog-ng reload >/dev/null
endscript
}
so, in /var/log/syslog, daily is replaced by size=10M.
which means the postrotate script will be executed
only when syslog reach 10M.
the side effect is that if another log grows faster
than syslog (for example i have a catchall log *.* to all.log),
all.log may be rotated, and syslog, which is still < 10M,
wont be rotated.
so syslog-ng will continue to log to all.log.1
annoying.
however, this is rarely the case ;
even if you set everything to logrotate based on size,
syslog has good chances to be the biggest, due to
the partial catch all.
in a normal debian install, this is never the case;
the script is executed daily, because the log rotation
is set so.
there could be a note in the logrotate man page,
(or anywhere else that fits) for warning the
user about using size based logrotation AND
using the
/etc/init.d/syslog-ng reload >/dev/null
command in the "/var/log/syslog { " entry
of /etc/logrotate.d/syslog-ng.
(even if this is rarely the case...)
opinions ?
thanks
xavier
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
