On Sunday 06 August 2006 09:43 pm, Andrew Sackville-West wrote: > On Sun, Aug 06, 2006 at 02:31:40PM +0000, Elmer E. Dow wrote: > > I discovered that /var/log/messages is 428.6 MB on my IBM R40 > > laptop running Sarge. I see /var/log/messages.1.gz, to > > messages.6.gz. None of those are more than 302 KB and they're a > > year old. Syslog is in a similar situation. Other log files > > aren't so big, but they haven't been rotated in a year either. > > Why did rotation stop? How do I start it again? Logrotate was > > installed. I just got rid of it. Could it have been > > interfering? > > umm... logrotate rotates the logs. removing it will prevent the > logs from being rotated. check man logrotate to get the output > from logrotate emailed to you so you can see what it happening. > you should confirm that there is still a cron job for log rotate. > When I've had problems with logrotate in the past is has been a > permissions issue, so maybe you have changed some permissons > inadvertantly causing this problem. > > A
From the reading I've done recently, I was under the impression that Debian (unlike RedHat) used syslogd and cron to handle log rotation. According to http://www.ducea.com/2006/06/06/rotating-linux-log-files/ , log rotation is handled in two ways on a Debian system (in contrast to RedHat, etc.). Most system log files are rotated by syslog itself and not by using logrotate. Logrotate is the default choice for all other log files (application logs). Indeed, /etc/logrotate.d contains scripts for apps (aptitude, exim4-base, ppp, etc.), while # /usr/sbin/syslogd-listfiles --weekly /var/log/mail.warn /var/log/uucp.log /var/log/user.log /var/log/daemon.log /var/log/messages /var/log/debug /var/log/auth.log /var/log/mail.err /var/log/mail.log /var/log/kern.log /var/log/lpr.log /var/log/mail.info R40:/home/ellsworth# Logrotate isn't listed in a cron job since I deleted the logroate package, but strangely logrotate.d still exists. I hope that reinstalling logrotate will set it up again. You're right, I need to put logrotate back for the apps, but it appears that it's syslogd's responsibility to rotate system logs. I've seen quite a bit online about changing a Debian system to use logrotate for system files, but I haven't done that here. Feel free to enlighten me if I'm wrong in my understanding of this. What could I have done to have messed up what syslogd should be doing? I checked, and syslogd has a script file in cron.daily and cron.weekly with correct permissions. Now what? -- Elmer E. Dow
