[TriLUG] log rotation wierdness

[Rosenstrauch, David]

> Anyone heard of a bug or mis-configuration that causes most 
> log files to be
> written to <logname>.1 instead of <logname>?
> 
> For instance, our /var/log/messages never has anything in it. 
>  Today it looks
> like:
>  > -rw-------  1 root  root           0 Jan  8 04:04 messages
>  > -rw-------  1 root  root     3060527 Jan  8 18:35 messages.1
>  > -rw-------  1 root  root      593454 Jan  1 22:50 messages.2
> The most recent messages are always in /var/log/messages.1
> 
> The system is CentOS 4.
> 
> TIA,
> C


Here's the logrotate entry that got installed for syslog-ng on my box (Arch Linux):

[darose at vnyc190562661 ~]$ cat /etc/logrotate.d/syslog-ng
/var/log/messages.log /var/log/auth.log /var/log/mail.log /var/log/kernel.log /var/log/errors.log /var/log/daemon.log /var/log/user.log /var/log/iptables.log
 /var/log/everything.log /var/log/syslog.log  {
        missingok
        sharedscripts
        postrotate
                /bin/kill -HUP `cat /var/run/syslog-ng.pid 2>/dev/null`  2> /dev/null || true
        endscript
}

I think the postrotate option (and perhaps also copytruncate - not used here) might control this behavior.  You can read more about these via "man logrotate".

HTH,

DR

==============================================================================
Please access the attached hyperlink for an important electronic communications disclaimer: 

http://www.csfb.com/legal_terms/disclaimer_external_email.shtml

==============================================================================