The rsyslog configuration I have has messages, kern and ssh log. I see the
active file(s) as messages | kern | ssh log.1 and all have 'delaycompress'
in the /etc/logrotate.d/ snippet:

/var/log/ssh.log /var/log/messages /var/log/kern.log {
rotate 7
daily
missingok
notifempty
delaycompress
compress
postrotate
invoke-rc.d rsyslog rotate > /dev/null
endscript
}

Reply via email to