syslog stuff (was RE: wireless stoped working)

[Carruth, Rusty]

I didn't know it all, but I do know that /etc/logrotate.conf and
/etc/logrotate.d control, well, log rotation.

 

ISTR that "In the old days" syslogd would use 2 criteria to decide
whether to rotate the log - size of file and how long it had been since
last rotation.

 

I don't remember all the rules (like, if the file is zero length, does
the rotation happen anyway, or not), but do remember that you could get
a log rotated either because of size OR time.  A perusal of
/etc/logrotate.d/* will reveal a lot of interesting stuff...  (Along
with a man page perusal J)

 

Notice that there are nifty 'commands' like 'rotate 10' and 'weekly'
which tell syslogd to keep 10 <unit of rotation time>'s copies of the
logs ('rotate 10'), and rotate the log files once per week ('weekly'),
regardless of size.  There are others, like 'compress' (to compress
them), and 'delaycompress' which apparently does not compress the 2 most
recent backup log files.

 

So, this means that somewhere in the configuration you should find
'daily', 'compress', 'delaycompress', and 'rotate 8' being applied to
/var/log/syslog.

 

On a slightly different topic, I have found that some versions of 'less'
will automatically decompress compressed files to text.  Or at least,
one time I mistakenly said 'less /var/log/syslog*' when some of them
were zipped, and LO! I didn't see any binary junk - it decompressed them
for me.  YMMV!

 

Rusty

 

From: plug-discuss-bounces at lists.plug.phoenix.az.us
[mailto:plug-discuss-bounces at lists.plug.phoenix.az.us] On Behalf Of
Michael Havens
Sent: Wednesday, May 09, 2012 9:17 PM
To: Main PLUG discussion list
Subject: Re: wireless stoped working

 

thanj you Larry!

On Wed, May 9, 2012 at 5:04 PM, Dazed_75 < > wrote:

Its not a matter of time but of file size.  Apparently gzip has (or had)
some limitation it needed to honer before the file got to the limit.

BTW, I found the easoest way to grep for something in one of the
compressed archives was to use something like 
  zcat /var/log/syslog.2.gz | grep cron | less

Larry



On Wed, May 9, 2012 at 5:56 AM, Stephen < > wrote:

But you seem to have done that part allready. You can check timestamps
to get a real sense of time logged.

On May 8, 2012 10:44 PM, "Michael Havens" <com <mailto:bmike1 at gmail.com>
> wrote:

So I get it.... it saves a total of 8 logs 6 of which are compressed and
so how long is each log a record of? From my inspection of the log it
seems as if it covers a little more than a day. Teach mw about this! I'm
all ears!

On Tue, May 8, 2012 at 10:26 PM, Michael Havens < > wrote:

you guys are so helpful. Well, there is a /var/log/syslog and syslog.1
but after that it is syslog.2-7.gz, not 'z'. Does that sound right?
Which is the most recent?

On Tue, May 8, 2012 at 10:51 AM, Carruth, Rusty <Rusty
<mailto:Rusty.Carruth at smartstoragesys.com>  wrote:

	You should see syslog.0, syslog.1, etc.  (possibly with .z on
the end).  Those are your older logs.

	 

	rusty

	 

	 

	---------------------------------------------------
	PLUG-discuss mailing list -
PLUG-discuss at lists.plug.phoenix.az.us
	To subscribe, unsubscribe, or to change your mail settings:
	http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss





 

-- 
:-)~MIKE~(-:





 

-- 
:-)~MIKE~(-:

---------------------------------------------------
PLUG-discuss mailing list - PLUG-discuss at lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss


---------------------------------------------------
PLUG-discuss mailing list - PLUG-discuss at lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss




-- 
Dazed_75 a.k.a. Larry

Please protect my address like I protect yours. When sending messages to
multiple recipients, always use the BCC: (Blind carbon copy) and not To:
or CC:. Remove all addresses from the message body before sending a
Forwarded message. This can prevent spy programs capturing addresses
from the recipient list and message body.

---------------------------------------------------
PLUG-discuss mailing list - PLUG-discuss at lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change your mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss





 

-- 
:-)~MIKE~(-:

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.PLUG.phoenix.az.us/pipermail/plug-discuss/attachments/20120510/185c0c1a/attachment.html>