Dnia 2024-02-23, o godz. 11:15:29
Nicolas George <geo...@nsup.org> napisał(a):
> Hi.
>
> It might be an obvious question, but I do not manage to find the
> obvious answer:
>
> How do I tell systemd's logging system to keep authentication logs for
> one year and mail logs for one month?
>
> Regards,
>
That is not a feature systemd's logging have. You'd have to make a
rsyslogd rule to put it in one directory, another one for the other use
then tweak logrotate rules to rotate and keep each of them for
different length.
Most packages already log to separate files and have separate logrotate
rules so often it is just changing a single line, for example auth.log
is rotated with rest of the default logs:
/var/log/syslog
/var/log/mail.log
/var/log/kern.log
/var/log/auth.log
/var/log/user.log
/var/log/cron.log
{
rotate 4
weekly
missingok
notifempty
compress
delaycompress
sharedscripts
postrotate
/usr/lib/rsyslog/rsyslog-rotate
endscript
}
so if you wanted to change only auth.log you'd copy the section, and remove it
from current one, like this:
/var/log/auth.log
{
rotate 53 # a year in weeks
weekly
missingok
notifempty
compress
delaycompress
sharedscripts
postrotate
/usr/lib/rsyslog/rsyslog-rotate
endscript
}
--
Mariusz Gronczewski (XANi) <xani...@gmail.com>
GnuPG: 0xEA8ACE64
https://devrandom.eu
