Is there any configuration for /var/log/messages of RHEL3

meihua_t · 05-24-2005, 06:16 AM

Hi

One of my customer is using RedHat Enterprise Linux 3. We are having problem of viewing few days ago information of /var/log/messages.

For example:
I log in and cat /var/log/messages today (24/5), the /var/log/messages only display today's information and time. It didn't show 23/5 or the day before that. I have tried to view at /var/log/messages.0 or 1 or 2 or 3, which it suppose to capture old information within a week, but it gives me the same result, I couldn't find the 23/5 day of /var/log/messages.

Hence, I would like to know whether there is any configuration to set to display only 1 day information in /var/log/messages.

Thanks.

Donboy · 06-01-2005, 03:30 PM

The logrotate package may be clearing the log everyday. Check /etc/logrotate.d/syslog and see if there is something that rotates the logs daily or whatever.

baijumichael · 06-08-2005, 10:01 AM

By default RHEL3 logrotate clears the /var/log/message and similar logs every week. This renames most recent weekly log to <log file>.1 and creates new log. It maintais 4 weeks logs using this. You can also customise this using /etc/logrotate.conf and adding individual file configuration for your file.

My recommendation : If syslog messages on a particular subsystem or daemon is to be captured for a long time , configure /etc/syslog.conf and capture them to a seperate log file. You can easily download manuals for them. or read manpages for syslog.conf.

Thanks,

Byju Michael

meihua_t · 06-13-2005, 10:06 PM

Dear Donboy,

I have checked on the /etc/logrotate.d/syslog, however it is a script which I cannot understand. I would appreciate if you could highlight to me whether it has stated any logs for daily or whatever.

/var/log/messages /var/log/secure /var/log/maillog /var/log/spooler /var/log/boot.log /var/log/cron {
sharedscripts
postrotate
/bin/kill –HUP ‘cat/var/run/syslogd.pid 2> /dev/null’ 2> /dev/null || true
endscript
}

Thanks.

Donboy · 06-13-2005, 11:45 PM

This particular script isn't showing how frequently your logs are rotated. Instead, they are being inherited from /etc/logrotate.conf. But you can put commands in this statement that will specify how often these particular log files are rotated.

Maybe you want to change your script to be more like this...

Code:

/var/log/messages /var/log/secure /var/log/maillog /var/log/spooler /var/log/boot.log /var/log/cron {
	sharedscripts
	daily
	rotate 7
	compress    
	postrotate
	/bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
	endscript
}

This will rotate the log files daily and keep 7 days worth of old logs. If you don't want the old archives to be zipped, just remove the word "compress" from this block of commands.

Check "man logrotate" for more info. Right after the examples in the man pages, you'll see all these commands that are mystifying you.