How to tar.gz old maillog & messages during log rotation?

[sneader]

These logs are automatically tar.gz'd during the log rotation process:

exim_mainlog
exim_rejectlog
exim_paniclog
chkservd.log

However, these logs are not... and I'd like them to be, since /var is a little low on disk space:

maillog
messages

Any pointers in accomplishing this, and any ideas why some logs are tar.gz'd and others are not?

Thanks!

- Scott

[Hoss]

This is really quite simple to do.
Log into you server either via SSH or SFTP (I find it easier to edit files via SFTP/edit, but...)

go to the folder /etc/logrotate.d
And open/edit the file named syslog
It should look simlar to this when you open it

/var/log/secure /var/log/maillog /var/log/spooler /var/log/boot.log /var/log/cron {
weekly
create 0600 root root
rotate 4
nocompress
notifempty
sharedscripts
postrotate
/bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
endscript
}

/var/log/messages {
weekly
create 0660 root root
rotate 4
nocompress
postrotate
/bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
endscript
}

What you're insterested in is the 'nocompress' value. If you change that to compress then they will be gzipped upon rotation.
The value of weekly tells logrotate how often to rotate the logs. Compress to gzip them, etc... If you google logrotate you will find all options available explaned and it's quite simple.

Now be aware that if your syslog like mine is using a shared script for these log files...
/var/log/secure /var/log/maillog /var/log/spooler /var/log/boot.log /var/log/cron
Changing the value to compress will gzip all the files listed above.

Easy to fix. Delete the following from that sharedscript line
/var/log/maillog
and we'll create a new entry just for that log file. And paste it below.

/var/log/maillog {
weekly
create 0600 root root
rotate 4
compress
postrotate
/bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
endscript
}

So the new syslog will look like this when you're done

/var/log/secure /var/log/spooler /var/log/boot.log /var/log/cron {
weekly
create 0600 root root
rotate 4
nocompress
notifempty
sharedscripts
postrotate
/bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
endscript
}

/var/log/messages {
weekly
create 0660 root root
rotate 4
compress
postrotate
/bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
endscript
}

/var/log/maillog {
weekly
create 0600 root root
rotate 4
compress
notifempty
postrotate
/bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
/bin/kill -HUP `cat /var/run/rsyslogd.pid 2> /dev/null` 2> /dev/null || true
endscript
}

Make the neccesary edits and save the file. You're all done!
You can modify all your system log rotations in this folder using the same meathods. You can set them to rotate by size of file, monthly, yearly, howmany files to save/rotate, etc...

You'll find the conf for non system files in the file etc/logrotate.conf

You can test your logrotate for error by issueing this command in SSH it will 'force' the rotation of all files and print out the results to your screen
/usr/sbin/logrotate -vf /etc/logrotate.conf

[sneader]

Thanks Hoss!

I wonder why cPanel, by default, uses compression on some of these log files, and not others? Maybe someone from cPanel will wonder by and answer.

- Scott

[Hoss]

That is the default setup is all
And some of us prefer logs to be compressed and some not, it's all about your prefs m8

You may want to reread what I entered above as I think I was editing my post when you posted.
I just changed a few of the values is all.

[cPanelDon]

I wonder why cPanel, by default, uses compression on some of these log files, and not others? Maybe someone from cPanel will wonder by and answer.

- Scott

cPanel does not handle the described log rotation being referenced; this is actually handled by the logrotate software package (RPM) and configuration that is provided with your OS installation.

I recommend referring to the logrotate manual "man" documentation and help information as accessed via the following commands:

# man logrotate
# logrotate --help