Hylton Conacher (ZR1HPC) wrote:

...

I would like to check my system is logrotating as I cannot have the partition it is outgrow the HDD.

How would I check, besides viewing the cron_daily etc scripts, that the logrotated had run and compressed any of my logs?

Check your /var/log directory. You should see multiple versions of rotated files. mmm, I do see a few <logfilename>-<date>.gz files. I would assume that

James Knott wrote: Thanks James, these are also deleted by the 'rotate' option in /etc/logrotate.conf but I see that I have files there from Jan and yet rotate in the above file is set to 4 ? (Tnx Pat you got me to look at the man page :) ) -- The Little Helper ======================================================================== Hylton Conacher - Linux user # 229959 at http://counter.li.org Currently using SuSE 9.0 Professional with KDE 3.1 Licenced Windows user ========================================================================

Patrick Shanahan wrote:

* Hylton Conacher (ZR1HPC) [08-30-04 04:02]:

...

How would I check, besides viewing the cron_daily etc scripts, that the logrotated had run and compressed any of my logs? ...

...

P.S.: Anything besides 'man logrotate' Pat?

:^)

why not look at the config files for logrotate and see which files should have compression/rotation performed, then display the directories where those files exist? ie:

partial view of /etc/logrotate.d/syslog

/var/log/warn /var/log/messages /var/log/allmessages /var/log/localmessages /var/log/firewall { compress dateext maxage 365 rotate 99 missingok notifempty size +4096k create 640 root root sharedscripts postrotate /etc/init.d/syslog reload endscript }

so logrotate/digest will perform on /var/log/warn, /var/log/messages.... Thanks Pat. Now I see a little clearer on the log file issue. So if I wanted to add another system log file to be rotated like the ones already listed how do I decide on which I should just add into the /etc/logrotate.d/syslog file?

so on commandline or in your file browser of choice look in /var/log for warn*

In my system I see (abreviated):

/var/log/warn ..... I got a fortune of wtmp.gz files that go way back to Jan 2004. I tried using OOo to view the ungzipped wtmp file but got 34 pages of rubbish. To get rid of the number of wtmp files held, where do I edit the 'maxage' option as I do not see a /var/log/wtmp entry in the /var/log/syslog file. Should I rather edit the maxage of the /etc/logrotate.d/wtmp file??

so I may conclude that files are being condensed/compressed and rotated.

Now, that wasn't so hard, was it? The thing to learn is not what was done, but how it was approached.

I have to admit with your explanation and a bit of man reading the log file rotation is a little clearer to me. :) Now it wasn't so hard, was it? To provide a substantial answer to my question as opposed to 'man logrotate', eventhough it was the ps answer. :) Thanks very much Pat

NOTE: The manner you posed your question deserved the *long* explanation rather than the exemplary 'RTFM'.

NOTE: The long manner you answered the question rather than the 'RTFM' was appreciated. -- The Little Helper ======================================================================== Hylton Conacher - Linux user # 229959 at http://counter.li.org Currently using SuSE 9.0 Professional with KDE 3.1 Licenced Windows user ========================================================================

On Tuesday 31 August 2004 01:48 pm, Patrick Shanahan wrote:

the files you place in /etc/logrotate.d/ are expected by the system to be files for logrotate/logdigest to act on. Open several of the files and look at their contents. Read the man page for an explanation and examples of use of the different parameters.

...

I got a fortune of wtmp.gz files that go way back to Jan 2004.

OK, jumping in on this thread, I also have a gazillion files in /var/log/ such as localmessage, mail, messages , and various XF86 files, some going back to early 2003. Now, none of these are listed in the /etc/logrotate.d/ directory. Can I just add these categories to that directory by making new files?

edit the maxage paramter in /etc/logrotat.d/wtmp, it is in daz.

.... Each of the files in /etc/logrotate.d/ should contain the 'maxage' parameter. If not, they will never be deleted.

Bob S.

On Wednesday 01 September 2004 02:16, Scott Jones wrote:

On Wednesday 01 September 2004 00:28, Bob S. wrote:

...

...

...

I got a fortune of wtmp.gz files that go way back to Jan 2004.

OK, jumping in on this thread, I also have a gazillion files in /var/log/ such as localmessage, mail, messages , and various XF86 files, some going back to early 2003. Now, none of these are listed in the /etc/logrotate.d/ directory. Can I just add these categories to that directory by making new files?

Sure. That's what I do on my mailserver. With all the domains we host, qmail, qmail-scanner and clamav tend to be generous with the logs after getting hammered with spam and viruses. I have to rotate those, as well as the firewall logs, hourly.

The files in /etc/logrotate.d/ are good working examples, and don't forget that "man logrotate" is your friend.

-- Homepage http://scott.exti.net XFce desktop environment http://www.xfce.org Goodies for the XFce desktop http://xfce-goodies.berlios.de GPG public key ID: 811B00AB I'm just a little puzzled. The 'logrotate.conf' file has the following: # see "man logrotate" for details # rotate log files weekly weekly

# keep 4 weeks worth of backlogs rotate 4 ...and the /etc/logrotate.d/syslog contains: /var/log/warn /var/log/messages /var/log/allmessages /var/log/localmessages / var/log/firewall { compress dateext maxage 365 rotate 99 missingok notifempty size +4096k create 640 root root sharedscripts postrotate /etc/init.d/syslog reload endscript ...which seems to be contradictory. I have done 'man logrotate' & the 'maxage' seems nowhere in the docs. Some time back, I finally put '--force' in the logrotate script so that they'd be archived daily. Still, I have had to manually mv logs out of /var/log because they're not rotating at all. -- ..."Yogi" CH Namasté Yoga Studio "If music be the food of love, why can't rabbits sing?"

On Wednesday 01 September 2004 08:27, Patrick Shanahan wrote: <SNIP>

from logrotate man page maxage count Remove rotated logs older than <count> days. The age is only checked if the log­ file is to be rotated. The files are mailed to the configured address if mail­ last and mail are configured.

If you want the files rotated daily, instead of using '--force', why don't you set the parameter to 'daily' in /etc/logrotate.d/syslog?

Above you have:

...

I'm just a little puzzled. The 'logrotate.conf' file has the following: # see "man logrotate" for details # rotate log files weekly weekly

# keep 4 weeks worth of backlogs rotate 4

rotate count Log files are rotated <count> times before being removed or mailed to the address specified in a mail directive. If count is 0, old versions are removed rather then rotated.

rotate is based on '# of times' and maxage on '# of days' -- Patrick Shanahan Registered Linux User #207535 http://wahoo.no-ip.org @ http://counter.li.org HOG # US1244711 Photo Album: http://wahoo.no-ip.org/photos Thanks! I don't know how I missed the 'maxcount'... but I did. Now, it is making a little more sense. :-) -- ..."Yogi" CH Namasté Yoga Studio "If music be the food of love, why can't rabbits sing?"