LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Server (https://www.linuxquestions.org/questions/linux-server-73/)
-   -   maillog 90 day retention (https://www.linuxquestions.org/questions/linux-server-73/maillog-90-day-retention-4175644000/)

awreneau 12-10-2018 08:14 AM
maillog 90 day retention
 
Business requirements define maillog retention @ 90 days. I've commented out /var/log/maillog in /etc/logrotate.d/syslog, commented out compression ( I may change that later) and created a new file for maillog in the same directory w/ the following content

Code:
/var/log/maillog {
#    compress
    daily
    rotate 90
    create 0600 root root
        postrotate
        /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
        /bin/kill -HUP `cat /var/run/rsyslogd.pid 2> /dev/null` 2> /dev/null || true
    endscript
}
My reservation is the HUP of syslogd.pid. Is that legit? Only the syslog file contains a similar line.

Thanks
WR

TenTenths 12-10-2018 09:17 AM
Looks legit and similar to what's in my logrotate config for maillog

awreneau 12-10-2018 09:34 AM
Thanks!

I think the syslog line is irrelevant as I'm running rsyslog on CentOS 7.5.
Thoughts?

Code:
# ps -ef | grep syslog | grep -v grep
root      949    1  0 Oct01 ?        00:03:36 /usr/sbin/rsyslogd -n

TenTenths 12-10-2018 09:39 AM
If that's the only syslog style daemon running, then yeah, makes sense to omit the other one.

scasey 12-10-2018 02:08 PM
Quote:
Originally Posted by lhadi4581 (Post 5935578)
I'm running Postfix Sendmail 2.6.6 and my SMTP logs seem to only be going back one month. How can I configure it to retain logs for a longer period of time?
If you have a question of your own, please open a new thread.
Be prepared in that thread to tell us what you've found in your searches and what you've tried.

awreneau 12-11-2018 10:41 AM
1st of thanks for the help.

I think I've found success. Originally I posed the question about which logging mechanism I should use. Turns out syslog was the correct afterall
Code:
/bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
I experimented with a few options but have settled on the following.

/etc/logrotate.d/maillog
Code:
/var/log/maillog
{
    missingok
    daily
    dateext
    rotate 90
    postrotate
        /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
    endscript
}
I'm not certain why but for a few iterations rsyslog was still had open connections to the rotated log file /var/log/maillog-20181211 and was not writing to the new /var/log/maillog. I had to restart rsyslogd in order for it to behave properly. However, I must've solved it unknowingly as it now works as expected. Thought I'd just update my post and leave this here for posterity.


All times are GMT -5. The time now is 02:13 AM.