It might be wise to include a set of /etc/logrotate.d/ files for syslog-ng users. I'm thinking a seperate package called syslogng-logrotate (or syslogng-extras). A seperate package to contain the additional /etc/logrotate.d/* files to allow easy logrotation. Mandrake has something setup but then again, it has a default logger installed during install. With Gentoo, this package would need to distinguish between which logger installed, etc. well, in brief, i'm finally getting my /var/log/cups /var/log/snort /var/log/apache folders finally being rotated with logrotate finally after simply copying the prepared /etc/logrotate.d/syslog-ng file over and over and renaming it to the appropriate cups/apache/snort paths. bah. time-consuming. Also, I setup bzip2 -9 compression within /etc/syslog-ng/syslog-ng.conf ... I do believe that Mandrake uses the same compression tactic...including for it's man files (including Redhat) It took me several months to get up off my lazy bum to figure-out how to filter stuff, etc. Also would be useful to add a commented out section within the /etc/syslog-ng/syslog-ng.conf about howto capture the syslog packets from a smc barricade or syslog enabled router) (I guess this is more or less more syslog-ng specific bug/feature request) Another item, i've got spamassassin & postfix setup to filter my incoming email. Unfortunately, postfix (& cron) likes to log quite a bit of useless info to /var/log/messages. I've setup a filter to filter cron messages to /var/log/cron and filter postfix messages to /var/log/postfix/info (as well as logrotate.d additions for maintainance). Now, *finally* /var/log/messages is quite quiet after bootup (and should be easily read for any errors when viewed on console /dev/tty12 after 12-24 hours away time. Reproducible: Always Steps to Reproduce: 1. Install syslog-ng 2. Install logrotate 3. Try to have nice & neat /var/log files Expected Results: an idea to shorten install/setup times
Lat I checked the syslog-ng.conf dumped everything into /var/log/messages, whcih is why logrotate.d only had the one entry. A separate package to install logrotate extras, would mean someone would also have to write the corresponding filters for syslog-ng. In the end, it would amount to someone telling you where you had to have your log files. Is currently easier to dump the gentoo setup of one file and write your own filters, rather than dump someone elses filters and remove the corresponding log files, IMHO.
well. i already have the majority of filters setup for syslog-ng with logrotate. it was *a mess* when I first installed syslog-ng w/ logrotate. logs were just *all over the place* for 6-12 mos. finally got around to cleaning stuff up. it took a coulple of days to learn syslog-ng (had to resort to the hefty manual...no simple howto either) and logrotate was a pain until i found that one little file named syslog-ng w/i logrotate.d (by accident)...logrotote was trivial to say the least and no amount of googling ever helped until i found that file. up to you guyz. i certainly enjoyed how mandrake setup their sys-logger ... it was basically 0 config time spent with it too.
i've place my tailered syslog-ng.conf & logrotate.d files up on my website: http://www.speakeasy.org/~rogerxx/files/etc/ (i'm pretty sure bzip2 compression on logrotate is set to default when specified in /etc/logrotate.conf) smc (and smc alterations to syslog-ng.conf) are my own config file for my device which uses syslog -- so this can be aafely ignored and is only there for reference. up to you guyz what you decide to do.
The files that end up in /etc/logrotate.d are the responsibility of the individual packages, not syslog-ng. The current syslog-ng setup in Gentoo Linux is deliberatly simple. It provides a working setup "out of the box" and leaves it up to the individual user to set things up as appropriate to his particular environment. What is "nice and neat" to you might be "too sparse" for someone else. You have done exactly what is intended for you to do - that is, customized your syslog-ng configuration so it is exactly what you need. This aspect of your bug report is not a bug. I think it's great that you have taken the time to create logrotate files for snort, apache, cups, etc. Please file individual bugs against these software packages to get the logrotate files added to the packages. You can point people to this bug for validation if you feel the need. I'm going to close this bug as INVALID since it isn't a problem with syslog-ng.
