RHEL5 syslog facility Local6 Logrotate configuration Issue

kamalkgarg · 01-07-2011, 03:57 AM

Hi,

I am using syslog Facility6 for the logs generated by an application. I have appended the following line in the /etc/syslog.conf

local6.* /var/log/app.log

And my application logs are successfully getting created in /var/log/app.log. So no issues with syslog.

Here is what I further need to do:

I need to rotate these logs (/var/log/app.log) daily or whenever the size of the file exceeds 1MB. Also I would like to keep 60 log files.

I am not sure about configuring the logrotation based on the above criterion for syslog local6.* logs in RHEL5.

Thanks in advance !

Kamal

unSpawn · 01-07-2011, 05:04 AM

Reading 'man logrotate' and checking out the examples in /etc/logrotate.d/ should get you there. The facility does not matter and make sure you restart (kill -HUP) syslogd. If unsure create the logrotate script for app and fill it with what you require and post it.

kamalkgarg · 01-07-2011, 05:12 AM

ok.. so I can also create a logrotate configuration file for /var/log/app.log in /etc/logrotate.d

Thanks for your reply !

Regards,
Kamal

kamalkgarg · 01-07-2011, 05:30 AM

I created the a file /etc/logrotate.d/app with the following contents

/var/log/app.log {
daily
rotate 60
size 1M
postrotate
/usr/bin/killall -HUP syslogd
endscript
}

I think this will do the job?

Regards,
Kamal

kamalkgarg · 01-07-2011, 06:06 AM

Executed logrotate -f /etc/logrotate.conf command and logs are getting rotated every time I execute this command.

But /var/log/app.log is not getting rotated when it's size exceeds 1M even though i have mentioned the same in /etc/logrotate.d/app.

Is there any further configuration required to be done for log file to rotate immediately when the size exceeds 1M?

Thanks,
Kamal

unSpawn · 01-07-2011, 06:18 AM

Quote:

Originally Posted by kamalkgarg

/var/log/app.log is not getting rotated when it's size exceeds 1M even though i have mentioned the same in /etc/logrotate.d/app.

Remove the "daily" directive, prohibiting the log file from getting rotated every day. Then test by letting the log file exceed 1M and run 'logrotate -d /etc/logrotate.d/app'. Confirm the output alerts you the log now needs to be rotated.

kamalkgarg · 01-07-2011, 06:43 AM

Removing the daily directive from /etc/logrotoate.d/app didn't help.

However I added the following command in crontab to trigger logrotate every minute

* * * * * /usr/sbin/logrotate /etc/logrotate.conf

After this update, /var/log/app.log are getting rotated on size exceeding 1M.

But I don't know how is this going to affect other stuff.

Any idea?

unSpawn · 01-07-2011, 07:22 AM

Quote:

Originally Posted by kamalkgarg

Removing the daily directive from /etc/logrotoate.d/app didn't help.

As a technical person (or so I would hope) you should realize "didn't help" and "doesn't work" are about the least interesting things to reply especially since I showed you how to debug logrotate. if that isn't a hint I'm ready to repeat that but with caps lock on.

Quote:

Originally Posted by kamalkgarg

But I don't know how is this going to affect other stuff.

Logrotate can easily run at an interval shorter than once a day but FCOL! If you don't know how running logrotate every minute will affect "other stuff" then why the ${PURPORTEDLY_EXCEEDINGLY_WARM_LOCATION} do you do stuff like that in the first place?

kamalkgarg · 01-10-2011, 04:08 AM

thanks !