My preference for server side Linux is Debian 4. As with most distributions, most of the system files are rotated on a daily, weekly, and monthly basis by logrotate. For example, in Debian the log files for apache2, aptitude, and clamav are all handled by logrotate, and the configuration files are located in /etc/logrotate.d/
/var/log/apache2/*.log {
monthly
missingok
rotate 24
compress
delaycompress
notifempty
create 640 root www-data
sharedscripts
postrotate
if [ -f /var/run/apache2.pid ]; then
/etc/init.d/apache2 restart > /dev/null
fi
endscript
}
I was finding that my postfix log, mail.log, was getting rotated more often, even though it was really not very large. Sometimes it would rotat every day, sometimes every two days. But I couldn’t find any logrotate config files for the postfix logs. After a bit of searching I discovered that the mail facilities are handled by savelog, which operates in sysklogd. sysklogd is a script that runs in the daily cron at /etc/cron.daily/sysklogd.
A bit of the script is here, and you can see the savelog command:
cd /var/log
for LOG in `syslogd-listfiles`
do
if [ -s $LOG ]; then
savelog -g adm -m 640 -u root -c 7 $LOG >/dev/null
fi
done
So what is syslogd-listfiles? It will show you all files that are to be logged with syslogd.
silver:/etc/cron.daily# syslogd-listfiles --all
/var/log/mail.warn
/var/log/uucp.log
/var/log/user.log
/var/log/daemon.log
/var/log/messages
/var/log/debug
/var/log/auth.log
/var/log/mail.err
/var/log/syslog
/var/log/mail.log
/var/log/mail.info
/var/log/kern.log
/var/log/lpr.log