Using Logrotate with Syslog-ng (Unslung 6.8)

With much help and support from the mailing list, I have configured syslog-ng to receive log messages from both my adsl/voip router and from the slug itself. After some time, these logs get quite large in size so I examined a way to compress/rotate the logs. Logrotate is an Optware package. To install...

        ipkg update
        ipkg install logrotate

This creates a number of files. In /opt/etc there is logrotate.conf and logrotate.d, while in /opt/sbin you will find the logrotate program. The install also adds a file in /opt/etc/cron.d, however I have been informed by the NSLU2 list that slugs using Unslung (I am using 6.8 beta) do not reference/read the cron.d file.

>> This isn't correct. "include /opt/etc/cron.d" tells logrotate to merge all the configuration files in that directory - and if you test it, it does.

I needed to edit the logrotate.conf file to to make it work with syslog-ng. Again a big thanks to the NSLU2 forum for their assistance with this. My working logrotate.conf file is below (I used nano to edit). The /opt/var/log directory contains the logs created by syslog-ng...in my case called syslog and router. You will need to change these to reflect your log names/paths.

        compress

        /opt/var/log/router /opt/var/log/syslog {
                   rotate 5
                   postrotate
                            /bin/killall -HUP syslog-ng
                   endscript
                   }

        include /opt/etc/logrotate.d

I believe that logrotate is supposed to move the compressed files to opt/etc/logrotate.d but this does not occur for me so I guess their is an error with the last line. However the program works fine without this so I did not tinker :)

>> Actually, no. include means to include the specified file (in this case, all the files in the directory /opt/etc/logrotate.d except *.{rpmorig,rpmsave,',v',.swp,.rpm-new & ~}) at this point in the config file. This allows another package's install script to just drop a file with it's requirements into /opt/etc/logrotate.d instead of editing the main config file. Also, you were missing a / in /opt/ar/log/syslog, and as Julius notes below, you really want sharedscripts.

A slightly better setup would be:

  /opt/etc/logrotate.conf
        compress
        tabooext + .disabled

        include /opt/etc/logrotate.d

  /opt/etc/logrotate.d/syslog-ng.conf
        /opt/var/log/router opt/var/log/messages {
                   rotate 5
                   sharedscripts
                   delaycompress
                   postrotate
                            /bin/killall -HUP syslog-ng
                   endscript
                   }

  /opt/etc/logrotate.d/syslog.conf.disabled
        /var/log/messages {
                   rotate 5
                   delaycompress
                   postrotate
                            /bin/killall syslogd
                            /bin/killall klogd
                   endscript
                  }

The .disabled extension makes it easy to switch logrotate from syslog to syslog-ng. delaycompress is because syslsog won't release the log file until the postrotate script runs, but compression runs before that. There doesn't seem to be a quicker race-free way to make this work. (firstaction/lastaction also seem to come a the wrong time)

Of course, any other package install just adds its snippet to logrotate.d. And uninstall removes it.

syslog-ng has problems with logrotate prior to syslog-ng 2.0.9 and glib 2.2.12. Any kill or termination of syslog-ng can cause it to become very confused. At this writing, the new syslog is in the ipkg feed - so upgrade! The new glib has been requested.

  --tlhackque

I then needed to set up a cron job for this to run. I am new to the slug so am not sure if this is the correct way and I am sure there are other/better ways. I simply opened up the file crontab in the /etc directory and added the following line into the cron jobs..

         0 * * * * root /opt/sbin/logrotate -f /opt/etc/logrotate.conf &>/dev/null

In this case, this runs this cron job every hour on the hour. I used this setting initially to check if it worked Ok. This created the files in my opt/var/log called router.1.gz, router.2.gz etc etc. Notice the "rotate 5" comment. Change this number to reflect how many versions of the logs you wish to keep. Once it reaches 5, it will begin to overwrite the existing logs. I then modified the time/date settings to meet my specific requirements.

As I mentioned this is not my own work, but rather a product of the assistance given to me by the NSLU2 forums (Thanks Fernando, Mike, Rod and Ovidiu Sas). I hope this can assist others.

Cheers

===

For me the better option is the following /opt/etc/logrotate.conf file:

         nocompress
         sharedscripts
         olddir oldlog

         /opt/var/log/* {
                 rotate 5
                 size 100k
                 postrotate
                         /opt/etc/init.d/S01syslog-ng
                 endscript
         }

nocompress

I do not need compression

sharedscripts

Since I use a wildcard to logrotate all logfiles of the logging-directory, I want the postrotate script (restarting the system logger) to run only once

olddir

I put all my old loggings in a subdirectory 'oldlog'. Please note to create this directory before runnig logrotate

I used the following line in the /opt/etc/crontab file

         15 0 * * * root /opt/sbin/logrotate /opt/etc/logrotate.conf &>/dev/null

The logrotate script will be run every night at 00:15.

Julius

===