I was a bit confused as to why my /var/log/syslog was getting rotated every day, while everything else was weekly, or handled directly by a specific configuration in /etc/logrotate.d/.

The script at /etc/cron.daily/syslogd will rotate all files that are the output syslogd-listfiles each day. The same script at /etc/cron.weekly/syslogd will rotate all files that are the output of syslogd-listfiles --weekly on a weekly basis.

syslogd-listfiles is controlled by /etc/syslog.conf. Near the top of the configuration file, you’ll see the configuration for syslog:

*.*;auth,authpriv.none    -/var/log/syslog

The “*.*” is an ‘everything’ directive (see my $everything in /usr/sbin/syslogd-listfiles). My goal was to preserve my syslog for more than seven days since it is a relatively inactive machine. I ended up adding a new directive to allow the syslog (and auth) messages to be logged and rotated every day, and logged to syslog which will only be rotated once a week.

*.*;auth,authpriv.none     -/var/log/syslog_everything
syslog.*;auth,authpriv.none      -/var/log/syslog

It might be a bit clumsy but it solves my two problems, by creating two syslogs.

• I need *.* to be logged somewhere as a catchall
• I want syslog to be rotated only once a week

You definitely do not want to do this on a busy machine, but if your syslogs are not that big and you want to keep them around a while, this is a good way to accomplish that.