On Fri, 27 Jan 2012, Michael Maymann wrote:
Hi,
David: thanks for another quick reply - much appreciated...:-) !
Ok, I will try to get access to our DNS server, and have a look at the logs
there.
1. How does my rsyslog.conf and logrotate.d/rsyslog look ?
I'm not that familiar with logrotate, but I'm not seeing anything grossly
wrong
2. Is logrotate looking at each logfiles fileage (and rotate when the
fileage
is more than 1 month old) or does it rotate the files every 1st of the
month ?
3. We use SIS and think of dedublication (from NetAPP) instead of
compressing data during logrotate - any experience, recommendations ?
dedup is generally aimed at full files, and even if it goes to lower
levels than that it is only going to go down to the block level, so it's
very unlikely that dedup will help you with log data at all (the chance of
two blocks of logs being identical is very low)
David Lang
Thanks in advance :-) !
~maymann
2012/1/27 <[email protected]>
the surest way to tell that the DNS cache is working is to look at traffic
to your DNS server (or more precisely the lack of traffic to that host)
any way of checking in rsyslog itself is something that is brand new
thing. There may be something in the rsyslog documentation, but I don't
know anything about it.
David Lang
On Fri, 27 Jan 2012, Michael Maymann wrote:
Date: Fri, 27 Jan 2012 15:53:30 +0100
From: Michael Maymann <[email protected]>
Reply-To: rsyslog-users <[email protected]>
To: rsyslog-users <[email protected]>
Subject: Re: [rsyslog] Syslogging FQDN logfile/logdir howto/links/examples
Hi List,
Please - anyone who can help with this ?
Thanks in advance :-) !
~maymann
2012/1/25 Michael Maymann <[email protected]>
Hi,
1. how do I test if dns-cache is enabled in v6.3.6-devel (strace rsyslog
-c6... what to look for...?) ?
2. This is my current rsyslog.conf - comments are very welcome (any thing
that looks odd to you...?):
---
#LOAD MODULES
$ModLoad imtcp
$InputTCPServerRun 514
#SET DESTINATION FOR LOGS
$template
DYNmessages,"/local/logs/%**FROMHOST%/%FROMHOST%_%$YEAR%.%**
$MONTH%_messages"
$template
DYNsecure,"/local/logs/%**FROMHOST%/%FROMHOST%_%$YEAR%.%**
$MONTH%_secure"
$template
DYNmaillog,"/local/logs/%**FROMHOST%/%FROMHOST%_%$YEAR%.%**
$MONTH%_maillog"
$template DYNcron,"/local/logs/%**FROMHOST%/%FROMHOST%_%$YEAR%.%**
$MONTH%_cron"
$template
DYNspooler,"/local/logs/%**FROMHOST%/%FROMHOST%_%$YEAR%.%**
$MONTH%_spooler"
$template
DYNboot,"/local/logs/%**FROMHOST%/%FROMHOST%_%$YEAR%.%**
$MONTH%_boot.log"
$template
DYNtraps,"/local/logs/%**FROMHOST%/%FROMHOST%_%$YEAR%.%**$MONTH%_traps"
#SET LOGGING CONDITIONS
if $syslogseverity <= '6' then ?DYNmessages
if $syslogfacility-text == 'authpriv' then ?DYNsecure
if $syslogfacility-text == 'mail' then ?DYNmaillog
if $syslogfacility-text == 'cron' then ?DYNcron
if $syslogseverity-text == 'crit' then ?DYNspooler
if $syslogfacility-text == 'local7' then ?DYNboot
if $syslogfacility-text == 'local6' and $syslogseverity-text == 'WARNING'
then ?DYNtraps
---
3. A little off-topic - I have setup monthly logrotate:
/DIR_TO_LOGS/*/*
{
rotate 36
monthly
missingok
notifempty
# delaycompress
# compress
create 2750 _rsyslog rme_it
sharedscripts
postrotate
service rsyslog restart >/dev/null 2>&1 || true
endscript
}
3.a: is this looking at each logfiles fileage (and rotate when the
fileage
is more than 1 month old) or does it rotate the files every 1st of the
month ?
3.b: we use SIS and think of dedublication (from NetAPP) instead of
compressing data during logrotate - any experience, recommendations ?
Br.
~maymann
2012/1/19 Michael Maymann <[email protected]>
Hi David,
Thanks for your reply...:-) !
2012/1/19 <[email protected]>
On Thu, 19 Jan 2012, Michael Maymann wrote:
Hi,
Got it installed...:
yum install zlib-devel.x86_64
yum install byacc.x86_64
did the trick for me...
Thanks for your help Rainer...:-) !
Trying to look through the man-page and googling a bit...
1. do I have to enable DNS cache somewhere, or is this feature on by
default ?
I don't know
Ok, anyone who knows this ?
2. Is there some v6.3.6 version config examples somewhere. I would
need
to:
a. generally have logfiles in a
/NFS_logdir/FQDN/equial_to_****local_logfile_name (e.g. messages)
b. have maillog from mailcluster=host001 (host001a+host001b) being
merged
in a single /NFS_logdir/host001/maillog file
unless you are needing some 6.x specific feature, the configs from
earlier versions will still work.
I'm don't think I do...:-) - besides the DNS cache thing.
But I'm new to syslog/rsyslog and wondering if someone has a
link/example
to something similar to what I describe above.
David Lang
______________________________****_________________
rsyslog mailing list
http://lists.adiscon.net/****mailman/listinfo/rsyslog<http://lists.adiscon.net/**mailman/listinfo/rsyslog>
<http:**//lists.adiscon.net/mailman/**listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog>
http://www.rsyslog.com/****professional-services/<http://www.rsyslog.com/**professional-services/>
<http://**www.rsyslog.com/professional-**services/<http://www.rsyslog.com/professional-services/>
______________________________**_________________
rsyslog mailing list
http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog>
http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/>
______________________________**_________________
rsyslog mailing list
http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog>
http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/>
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
