Hi, David: thanks for another quick reply - much appreciated...:-) ! Ok, I will try to get access to our DNS server, and have a look at the logs there.
1. How does my rsyslog.conf and logrotate.d/rsyslog look ? 2. Is logrotate looking at each logfiles fileage (and rotate when the fileage is more than 1 month old) or does it rotate the files every 1st of the month ? 3. We use SIS and think of dedublication (from NetAPP) instead of compressing data during logrotate - any experience, recommendations ? Thanks in advance :-) ! ~maymann 2012/1/27 <[email protected]> > the surest way to tell that the DNS cache is working is to look at traffic > to your DNS server (or more precisely the lack of traffic to that host) > > any way of checking in rsyslog itself is something that is brand new > thing. There may be something in the rsyslog documentation, but I don't > know anything about it. > > David Lang > > On Fri, 27 Jan 2012, Michael Maymann wrote: > > Date: Fri, 27 Jan 2012 15:53:30 +0100 >> >> From: Michael Maymann <[email protected]> >> Reply-To: rsyslog-users <[email protected]> >> To: rsyslog-users <[email protected]> >> >> Subject: Re: [rsyslog] Syslogging FQDN logfile/logdir howto/links/examples >> >> Hi List, >> >> Please - anyone who can help with this ? >> >> >> Thanks in advance :-) ! >> ~maymann >> >> 2012/1/25 Michael Maymann <[email protected]> >> >> Hi, >>> >>> 1. how do I test if dns-cache is enabled in v6.3.6-devel (strace rsyslog >>> -c6... what to look for...?) ? >>> 2. This is my current rsyslog.conf - comments are very welcome (any thing >>> that looks odd to you...?): >>> --- >>> #LOAD MODULES >>> $ModLoad imtcp >>> $InputTCPServerRun 514 >>> >>> #SET DESTINATION FOR LOGS >>> $template >>> DYNmessages,"/local/logs/%**FROMHOST%/%FROMHOST%_%$YEAR%.%** >>> $MONTH%_messages" >>> $template >>> DYNsecure,"/local/logs/%**FROMHOST%/%FROMHOST%_%$YEAR%.%** >>> $MONTH%_secure" >>> $template >>> DYNmaillog,"/local/logs/%**FROMHOST%/%FROMHOST%_%$YEAR%.%** >>> $MONTH%_maillog" >>> $template DYNcron,"/local/logs/%**FROMHOST%/%FROMHOST%_%$YEAR%.%** >>> $MONTH%_cron" >>> $template >>> DYNspooler,"/local/logs/%**FROMHOST%/%FROMHOST%_%$YEAR%.%** >>> $MONTH%_spooler" >>> $template >>> DYNboot,"/local/logs/%**FROMHOST%/%FROMHOST%_%$YEAR%.%** >>> $MONTH%_boot.log" >>> $template >>> DYNtraps,"/local/logs/%**FROMHOST%/%FROMHOST%_%$YEAR%.%**$MONTH%_traps" >>> >>> #SET LOGGING CONDITIONS >>> if $syslogseverity <= '6' then ?DYNmessages >>> if $syslogfacility-text == 'authpriv' then ?DYNsecure >>> if $syslogfacility-text == 'mail' then ?DYNmaillog >>> if $syslogfacility-text == 'cron' then ?DYNcron >>> if $syslogseverity-text == 'crit' then ?DYNspooler >>> if $syslogfacility-text == 'local7' then ?DYNboot >>> if $syslogfacility-text == 'local6' and $syslogseverity-text == 'WARNING' >>> then ?DYNtraps >>> --- >>> >>> 3. A little off-topic - I have setup monthly logrotate: >>> /DIR_TO_LOGS/*/* >>> { >>> rotate 36 >>> monthly >>> missingok >>> notifempty >>> # delaycompress >>> # compress >>> create 2750 _rsyslog rme_it >>> sharedscripts >>> postrotate >>> service rsyslog restart >/dev/null 2>&1 || true >>> endscript >>> } >>> 3.a: is this looking at each logfiles fileage (and rotate when the >>> fileage >>> is more than 1 month old) or does it rotate the files every 1st of the >>> month ? >>> 3.b: we use SIS and think of dedublication (from NetAPP) instead of >>> compressing data during logrotate - any experience, recommendations ? >>> >>> >>> Br. >>> ~maymann >>> >>> >>> >>> 2012/1/19 Michael Maymann <[email protected]> >>> >>> Hi David, >>>> >>>> Thanks for your reply...:-) ! >>>> >>>> 2012/1/19 <[email protected]> >>>> >>>> On Thu, 19 Jan 2012, Michael Maymann wrote: >>>> >>>>> >>>>> Hi, >>>>> >>>>>> >>>>>> Got it installed...: >>>>>> yum install zlib-devel.x86_64 >>>>>> yum install byacc.x86_64 >>>>>> did the trick for me... >>>>>> Thanks for your help Rainer...:-) ! >>>>>> >>>>>> Trying to look through the man-page and googling a bit... >>>>>> 1. do I have to enable DNS cache somewhere, or is this feature on by >>>>>> default ? >>>>>> >>>>>> >>>>> I don't know >>>>> >>>> >>>> >>>> Ok, anyone who knows this ? >>>> >>>> >>>>> >>>>> 2. Is there some v6.3.6 version config examples somewhere. I would >>>>> need >>>>> >>>>>> to: >>>>>> a. generally have logfiles in a >>>>>> /NFS_logdir/FQDN/equial_to_****local_logfile_name (e.g. messages) >>>>>> >>>>>> b. have maillog from mailcluster=host001 (host001a+host001b) being >>>>>> merged >>>>>> in a single /NFS_logdir/host001/maillog file >>>>>> >>>>>> >>>>> unless you are needing some 6.x specific feature, the configs from >>>>> earlier versions will still work. >>>>> >>>>> >>>> I'm don't think I do...:-) - besides the DNS cache thing. >>>> But I'm new to syslog/rsyslog and wondering if someone has a >>>> link/example >>>> to something similar to what I describe above. >>>> >>>> >>>>> David Lang >>>>> >>>>> ______________________________****_________________ >>>>> rsyslog mailing list >>>>> http://lists.adiscon.net/****mailman/listinfo/rsyslog<http://lists.adiscon.net/**mailman/listinfo/rsyslog> >>>>> <http:**//lists.adiscon.net/mailman/**listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog> >>>>> > >>>>> http://www.rsyslog.com/****professional-services/<http://www.rsyslog.com/**professional-services/> >>>>> <http://**www.rsyslog.com/professional-**services/<http://www.rsyslog.com/professional-services/> >>>>> > >>>>> >>>>> >>>> >>>> >>> ______________________________**_________________ >> rsyslog mailing list >> http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog> >> http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/> >> >> ______________________________**_________________ > rsyslog mailing list > http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog> > http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/> > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/
