[SOLVED] maillog 90 day retention

awreneau · 12-10-2018, 08:14 AM

Business requirements define maillog retention @ 90 days. I've commented out /var/log/maillog in /etc/logrotate.d/syslog, commented out compression ( I may change that later) and created a new file for maillog in the same directory w/ the following content

Code:

/var/log/maillog {
#    compress
    daily
     rotate 90
    create 0600 root root
        postrotate
        /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
        /bin/kill -HUP `cat /var/run/rsyslogd.pid 2> /dev/null` 2> /dev/null || true
    endscript
}

My reservation is the HUP of syslogd.pid. Is that legit? Only the syslog file contains a similar line.

Thanks
WR

TenTenths · 12-10-2018, 09:17 AM

Looks legit and similar to what's in my logrotate config for maillog

awreneau · 12-10-2018, 09:34 AM

Thanks!

I think the syslog line is irrelevant as I'm running rsyslog on CentOS 7.5.
Thoughts?

Code:

# ps -ef | grep syslog | grep -v grep
root       949     1  0 Oct01 ?        00:03:36 /usr/sbin/rsyslogd -n

TenTenths · 12-10-2018, 09:39 AM

If that's the only syslog style daemon running, then yeah, makes sense to omit the other one.

scasey · 12-10-2018, 02:08 PM

Quote:

Originally Posted by lhadi4581

I'm running Postfix Sendmail 2.6.6 and my SMTP logs seem to only be going back one month. How can I configure it to retain logs for a longer period of time?

If you have a question of your own, please open a new thread.
Be prepared in that thread to tell us what you've found in your searches and what you've tried.

awreneau · 12-11-2018, 10:41 AM

1st of thanks for the help.

I think I've found success. Originally I posed the question about which logging mechanism I should use. Turns out syslog was the correct afterall

Code:

/bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true

I experimented with a few options but have settled on the following.

/etc/logrotate.d/maillog

Code:

/var/log/maillog
{
    missingok
    daily
    dateext
    rotate 90
    postrotate
        /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
    endscript
}

I'm not certain why but for a few iterations rsyslog was still had open connections to the rotated log file /var/log/maillog-20181211 and was not writing to the new /var/log/maillog. I had to restart rsyslogd in order for it to behave properly. However, I must've solved it unknowingly as it now works as expected. Thought I'd just update my post and leave this here for posterity.