On 2009-08-22 01:08 +0200, Andrew Reid wrote: > I have a multiply-upgraded Debian "etch" box, which is also a log > host (i.e. many other hosts log on it via the UDP port that syslog provides), > and our policies regarding log retention have recently changed. > > My problem is that I can't figure out who is rotating /var/log/auth.log. > > It's currently being rotated every day, and retained for a week. > > I spent a lot of quality time today with the logrotate documentation, > and I'm confident that it's not in any logrotate scripts.
If you are using sysklogd (the standard syslog daemon in Etch), the answer is that it uses savelog, not logrotate. See bug #44523¹. The good news is that in Lenny and later, rsyslog² is the standard syslog daemon, and it uses logrotate. Of course, upgrading an existing system will not change your syslog daemon. There is also an Etch backport of rsyslog, if you would like to use it without upgrading to Lenny. ¹ http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=44523 ² http://packages.debian.org/rsyslog -- To UNSUBSCRIBE, email to debian-user-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
