[[http://tmade.de|Home tmade.de]]

[[http://wiki.tmade.de|Home Wiki]]

===== Syslog =====

Config file facility:

  /usr/include/sys/syslog.h
  


==== syslog-ng ====
Detailed logging example for FTP!

Edit file:
  
  /etc/syslog-ng/syslog-ng.conf.in
  
Add filter:

<code>
filter f_local4debug { level(debug) and facility(local4); };
filter f_local4info  { level(info)  and facility(local4); };
filter f_local4      { facility(local4); };
filter f_ftp_info   { level(debug,info,debug) and facility(ftp); }; 	# To FTP (facilityname=ftp)

destination ftp_info   { file("/var/log/pure-ftpd.log");};
log { source(src); filter(f_ftp_info); destination(ftp_info); };

destination local4debug { file("/var/log/local4.debug"); };
log { source(src); filter(f_local4debug); destination(local4debug); };

destination local4info { file("/var/log/local4.info"); };
log { source(src); filter(f_local4info); destination(local4info); };

destination local4 { file("/var/log/local4"); };
log {source(src); filter(f_local4); destination(local4); };
</code>

==== Update ====

  /etc/syslog-ng/syslog-ng.conf with:

  SuSEconfig --module syslog-ng

==== Usage and test ====

  logger -p local4.info "my message"
  logger -p local4.debug "my message"
  logger -p local4 "my message"

==== Logrotate ====

See logrotate (/etc/logrotate.d/ and /etc/logrotate.conf) for more options/details.

Config examples are in:

  /etc/logrotate.d/
  
Copy existing file to new profilname (e.g.)

  cp pure-ftpd new_profile_name

and edit.

Execute manually to activate:

  logrotate /etc/logrotate.conf                         #all
or
  logrotate -d /etc/logrotate.d/new_profile_name        #Test "new_profile_name"
  logrotate /etc/logrotate.d/new_profile_name           #Rotates "new_profile_name"
  
Example file:

<code>
/var/log/nginx/*.log {
        #monthly                                                                                                                 #rotates once a month
        #daily                                                                                                                   #rotates once a day
        weekly                                                                                                                   #rotates once a week
        size 10M                                                                                                                 #rotates if file is >= 10 MB
        rotate 7                                                                                                                 #keeps 7 versions of logfiles
        compress                                                                                                                 #compress files
        compresscmd /bin/bzip2                                                                                                   #compress as bzip2
        delaycompress                                                                                                            #compress on 2. run (keeps always 2 versions of logfiles uncompessed)
        missingok                                                                                                                #avoids halting on any error and carries on with the next log file
        notifempty                                                                                                               #don´t rotate if file is empty
        postrotate                                                                                                               #execute command after rotation
                test ! -f /usr/local/nginx/sbin/nginx.pid || kill -USR1 `cat /usr/local/nginx/sbin/nginx.pid`
                #killall -USR1 nginx
        endscript                                                                                                                #required after postrotate/ command
        create 644 root root                                                                                                     #rotates files with 644 permission and owner/group as "root"
}
</code>