Syslog-ng messages.log log rotation

Iyyappan · 09-15-2012, 04:45 PM

Hi,
We have syslog configured and in one server logs alone has reached 32 GB. Now I have configure log-rotation like this

/var/log/remote.d/192.168.18.198/messages.log {
rotate 4
monthly
missingok
notifempty
compress
}

I have moved the messages.log file ( 32 GB) file to another location. I have created an empty file with same rights and ownerships. When will the newly created messages.log file will start to capture logs. Do I need to restart the service to make it capture logs.

acid_kewpie · 09-15-2012, 04:49 PM

the service? What service? logrotate is not a service, and has nothing to do with syslog-ng, they don't interact in any way. If you mean syslog-ng (then why have you included logrotate config??) then you may wish to hup / restart the syslog-ng daemon to close the file handles. Note that as far as logrotate goes, you should copy the config that the over files it creates, e.g. /var/log/messages use.

Iyyappan · 09-15-2012, 04:51 PM

messages.log file in /var/log/remote.d/192.168.18.198/ is about 32 GB. I need to retain the logs for the last 3 months. Thats y I configure log rotation monthly. I have created an empty messages.log file in /var/log/remote.d/192.168.18.198. Now the messages.log file is not getting updated. Thats y asked whether I need to restart syslog service, to make messages.log file to capture logs. Sylog-ng server is in Ubuntu 9.04

acid_kewpie · 09-16-2012, 11:10 AM

My above comments stand.