How to set up Debian syslog log rotation

The log rotation mechanism in the Debian system is usually managed by the rsyslog or syslog-ng service. This article will explain how to configure these two services to achieve log rotation separately.

1. Use rsyslog to configure log rotation

1. Install rsyslog (if not installed):

    sudo apt update
   sudo apt install rsyslog

2. Configure rsyslog:

   • Edit the /etc/rsyslog.conf file, or create a new configuration file and include it in the /etc/rsyslog.d/ directory.
   • Make sure the configuration file contains the following lines to enable log rotation:

   <code> $ModLoad imuxsock # 本地系统日志支持$ModLoad imklog # 内核日志支持$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat $IncludeConfig /etc/rsyslog.d/*.conf</code>

3. Configure log rotation policy:

   • Edit the /etc/logrotate.d/rsyslog file, or create a new configuration file under the /etc/logrotate.d/ directory.
   • Here is a sample configuration:

   <code> /var/log/syslog { rotate 7 # 保留7个日志文件daily # 每天轮转missingok # 日志文件丢失时不报错notifempty # 日志文件为空时不轮转compress # 压缩旧日志delaycompress # 延迟压缩，直到下次轮转postrotate /usr/lib/rsyslog/rsyslog-rotate # 轮转后执行的命令，重新加载rsyslog endscript }</code>

4. Test configuration:

    sudo logrotate -d /etc/logrotate.d/rsyslog # -d parameter is test mode and does not actually perform rotation

2. Use syslog-ng to configure log rotation

1. Install syslog-ng (if not installed):

    sudo apt update
   sudo apt install syslog-ng

2. Configure syslog-ng:

   • Edit the /etc/syslog-ng/syslog-ng.conf file.

   • Make sure the configuration file contains the necessary log reception and output configurations, such as:

      <code>source s_network { udp(ip(0.0.0.0) port(514)); tcp(ip(0.0.0.0) port(514)); }; destination d_syslog { file("/var/log/syslog" template("${ISODATE} ${HOST} ${LEVEL} ${MESSAGE}\n")); }; log { source(s_network); destination(d_syslog); };</code>

3. Configure log rotation policy:

   • Edit the /etc/logrotate.d/syslog-ng file, or create a new configuration file under the /etc/logrotate.d/ directory.
   • Here is a sample configuration:

   <code> /var/log/syslog { rotate 7 daily missingok notifempty compress delaycompress postrotate /usr/sbin/syslog-ng -F -f /etc/syslog-ng/syslog-ng.conf # 轮转后重新加载syslog-ng endscript }</code>

4. Test configuration:

    sudo logrotate -d /etc/logrotate.d/syslog-ng # -d parameter is test mode

Through the above steps, you can select rsyslog or syslog-ng according to the actual situation of the system and configure its log rotation policy. Remember to remove the -d parameter for actual log rotation. It is recommended to restart the corresponding log service after modifying the configuration file to make the configuration take effect.

The above is the detailed content of How to set up Debian syslog log rotation. For more information, please follow other related articles on the PHP Chinese website!