On Tue, 04 Jan 2005 16:21:40 +0000, Konstantin V. Gavrilenko
Post by Konstantin V. GavrilenkoPost by Joey McCoyI have to say, Metalog's automatic log rotation is a dream come true after
using syslog-ng, but logwatch (so far from what I've seen) does not do
very well with metalog, so I've switched back to syslog-ng for that only
reason. I've written myself a weekly log rotation script. It's
unfortunate, but only a small inconvenience in order to utilize the power
of logwatch. ;)
what stops you setting up the destination in such a way in syslog-ng.conf?
Nothing, obviously. :)
Post by Konstantin V. Gavrilenko# NETWORK LOGGING
destination d_fmnet {
file("/var/log/HOSTS/$HOST/$YEAR-$MONTH/$HOST-$FACILITY-$YEAR$MONTH"
owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes)
);
Here's how I do it: The clients all log remotely (via TCP, for
reliability), plus they keep a week's worth of logs locally:
destination messages { file("/var/log/messages.$WEEKDAY"
remove_if_older(100000)); };
destination remote { tcp("syslog"); };
log { source(src); destination(messages); };
log { source(src); destination(remote); };
The central server breaks them up into hourly log files, which are
readable by system administrators (wheel group):
destination messages {
file("/var/log/messages.d/$YEAR/$MONTH/$DAY/$HOUR.log"
create_dirs(yes)
group(wheel)
dir_group(wheel)
dir_perm(0770)
perm(0640)
template("$HOST $ISODATE
[$FACILITY:$PRIORITY:$PROGRAM] $MESSAGE\n")
);
};
I also use logsentry to monitor the logs, though I have been itching
to try tenshi. In /etc/logcheck/logcheck.sh, I gather up the logs like
this:
LOGDIR="/var/log/messages.d"
find $LOGDIR -path "$LOGDIR/.snapshot/\*" -prune \
-o -type f -name '*.log' -mtime -1 -print \
| xargs -r -n1 $LOGTAIL > $TMPDIR/check.$$
Logs are actually written on a NetApp Filer, thus the bit about
pruning the .snapshot directory. I also do this at the end to compress
logs older than a day, and remove old .offset files (created by
logtail):
# Clean Up
rm -f $TMPDIR/check.$$ $TMPDIR/checkoutput.$$ $TMPDIR/checkreport.$$
find $LOGDIR -path "$LOGDIR/.snapshot/\*" -prune \
-o -type f -name '*.log' -mtime +1 -print \
| xargs -r bzip2
find $LOGDIR -path "$LOGDIR/.snapshot/\*" -prune \
-o -type f -name '*.log.offset' -mtime +1 -print \
| xargs -r rm
No cron jobs (other than to run logsentry) and no sending signals to
daemons to close and reopen files.
--
Computer interfaces should never be made of meat.
Using GMail? Setting Reply-to address to <> disables this annoying feature.