syslog and logrotate

[Rick Stevens]

redhat at buglecreek.com wrote:

Please don't hijack threads.  If you're posting a new message, then post
a new (emphasis on NEW) message!

> Just want another opinion on how log rotation works in conjunction with
> syslog.  If you have a entry in syslog.conf something like this:
> kern.*     /home/user/logs/user.log 
> This should send kernel messages to the above file.  Now, unless I set
> up logrotate to rotate the log file it will continue to grow?

Yes, up to the maximum limit (syslog is limited to 2GB, I believe).

>                                                               Is there
> any other mechanism that would rotate a log file just because it is in
> syslog.conf?  The reason I ask is that we have a local application that
> writes log files that are being rotated and I can not figure out how
> (not in logrotate).  I suspect a user is running a command occasionally
> associated with the application to manually rotate the log.  Just wanted
> to see if I was missing anything.  

anacron does the log rotation--not crond.  anacron uses the data in the
/etc/cron.* directories to control its operation, whereas crond uses
the various /var/spool/cron/* files (aka "crontabs").

Why use anacron?  Check its man page.  anacron takes into account the
last time a job was run and any possible time that the computer may have
been down.  So if the current time is after a job _should_ have run
(possible if the machine was down at the time the job should run),
anacron will run it ASAP after booting.  crond is unaware of "down" time
and will only pick up from boot time, so jobs will not run until the
NEXT scheduled time.

As for log rotation, anacron sees /etc/cron.daily/logrotate, which reads
in /etc/logrotate.conf and /etc/logrotate.d and invokes logrotate to do
the dirty work.  Note that NONE of these use the contents of
/etc/syslog.conf to determine which files get rotated and when.

For example, if you do a daily log rotate at midnight and the machine
happened to be off at that time, right after boot anacron will run the
delayed rotation so each log file has only one day's info in it (well,
there will be some cruft from the last boot in there, but that'll be
minor).  crond wouldn't do the rotation until the NEXT midnight, so one
log file would have two days' info in it.  Is that bad?  Depends on what
you're trying to accomplish--I can't speak to that.

>                                  Also, there are no cronjobs.

No, anacron stuff won't show up in a "crontab -e" for any user.  The
"crontab" program only buggers crond's /var/spool/cron/* files.  You
must edit anacron's /etc/cron.*/* files manually.
----------------------------------------------------------------------
- Rick Stevens, Senior Systems Engineer     rstevens at vitalstream.com -
- VitalStream, Inc.                       http://www.vitalstream.com -
-                                                                    -
-               If the enemy's in range...so are you!                -
----------------------------------------------------------------------