I was a bit confused as to why my
/var/log/syslog was getting rotated every day, while everything else was weekly, or handled directly by a specific configuration in
The script at
/etc/cron.daily/syslogd will rotate all files that are the output
syslogd-listfiles each day. The same script at
/etc/cron.weekly/syslogd will rotate all files that are the output of
syslogd-listfiles --weekly on a weekly basis.
syslogd-listfiles is controlled by
/etc/syslog.conf. Near the top of the configuration file, you’ll see the configuration for syslog:
The “*.*” is an ‘everything’ directive (see my $everything in
/usr/sbin/syslogd-listfiles). My goal was to preserve my syslog for more than seven days since it is a relatively inactive machine. I ended up adding a new directive to allow the syslog (and auth) messages to be logged and rotated every day, and logged to syslog which will only be rotated once a week.
*.*;auth,authpriv.none -/var/log/syslog_everything syslog.*;auth,authpriv.none -/var/log/syslog
It might be a bit clumsy but it solves my two problems, by creating two syslogs.
- I need *.* to be logged somewhere as a catchall
- I want syslog to be rotated only once a week
You definitely do not want to do this on a busy machine, but if your syslogs are not that big and you want to keep them around a while, this is a good way to accomplish that.