Pix logging on syslog... logrotate does not work

logicalfuzz · 03-06-2006, 12:04 AM

Hello,
I have configured PIX to log into Linux syslog on my RHEL4 m/c. The logging works fine, but when i configured logrotate to rotate the log files on a daily basis , it does not seem to work. Actually there are a couple of more problems associated to this as well. (My intension is to rotate the log file everyday at 12:00 noon)

PROBLEM 1.
----------
To enable network based logging i run the syslog daemon with the command 'syslogd -r -m 0'. I did the following changes to reflect the same in /etc/init.d/syslog

Code:

...<snip>...
# Source config
if [ -f /etc/sysconfig/syslog ] ; then
        . /etc/sysconfig/syslog
else
        SYSLOGD_OPTIONS="-r -m 0"
        KLOGD_OPTIONS="-2"
fi

RETVAL=0

umask 077

start() {
        echo -n $"Starting system logger: "
        daemon syslogd $SYSLOGD_OPTIONS
        RETVAL=$?
        echo
        echo -n $"Starting kernel logger: "
        daemon klogd $KLOGD_OPTIONS
        echo
        [ $RETVAL -eq 0 ] && touch /var/lock/subsys/syslog
        return $RETVAL
}
...</snip>...

But this time 'service syslog start' fails!! (though it starts on manually running the command) Strangely, even when it shows failed, the service does start, as 'ps -ef | grep syslog' shows

Code:

root     25023     1  0 10:44 ?        00:00:00 syslogd -m 0

PROBLEM 2.
----------
Now i read the logrotate manpage and acordingly created the file /etc/logrotate.d/pix_rotate as follows:

Code:

#cat /etc/logrotate.d/pix_rotate
/var/log/pix/SyslogCatchAll.log {
                olddir DatedLogs
        postrotate
                /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
        endscript
}

Then i put the cron job as follows:
00 12 * * * /usr/sbin/logrotate

Well, this does not seem to work. How do i make it work? (I know i'd be overwriting the rotated log file everyday, but i hope 'extension `date`' in the file /etc/logrotate.d/pix_rotate would help).

Any help on this would be appreciated. i've been struggling with logrotate for quite a while!!!

[edit] I also made the following additions to /etc/logrotate.conf:

Code:

/var/log/pix/SyslogCatchAll.log {
       daily
       create 0664 root root
       rotate 120
}