Re: tmpfs

Hi Boris

I wrote the last message on a notepad sitting in a bar, no having access 
to my system may lead to errors.



     I am not a big fan of multiple logging services so take this with a
     grain of salt. Basically the logging service used by the various
     daemons depend on the configuration of each of those services. Most
     things in Linux can log to rsyslog. To distinguish these logs is a
     feature of rsyslog and needs to be configured there.

So these are the logrotate targets I have

SALT# ls
lighttpd   ntp        ntpd       shorewall  syslog     ulogd

SALT# grep DAEMON *
lighttpd:DAEMON=adm
lighttpd:DAEMON=lighttpd
ntp:DAEMON=rsyslog
ntpd:DAEMON=rsyslog
shorewall:DAEMON=ulogd
syslog:DAEMON=rsyslog
ulogd:DAEMON=ulogd

So lets look at these

lighttpd:DAEMON=adm
lighttpd:DAEMON=lighttpd

lighttpd has its own logging stuff. It can log to syslog which IMHO 
would be the best to do. I have not seen a way to assign this log a 
separate log facility though.

There is, to my knowledge, no service called adm. I have no clue where 
this comes from, and then the second assignment of DAEMON will overwrite 
the first, this is useless.

ntp:DAEMON=rsyslog
ntpd:DAEMON=rsyslog

SALT# diff ntp ntpd
--- ntp
+++ ntpd
@@ -1,5 +1,5 @@
  LOGS_WEEKLY="ntpd"
-LOGSIZE=4096
+LOGSIZE=512
  DAEMON=rsyslog
  METHOD=restart
  COMPRESS_ALL=1

These two logrotate entries make no sense. They refer to the same set of 
logfiles, the same frequency of logrotate, just with a different log size.

I don't know why we have two sets of these. I found thet in ntp.lrp 
there is only mention of /etc/logrotate.d/ntp. So I guess you can easily 
drop the ntpd configuration from /etc/logrotate.d. It may be there for 
historical reasons only. I am running the fully blown ntpd and not the 
one that comes with busysbox, so this may explain the difference.

Shorewall is logging to ulog, and ulogd does not really log much and can 
easily be just left as is.

hostapd AFAIK can only log to syslog or stdout ( and this only if it 
does not fork to background )

In my settings I have not defined a separate syslog file for hostapd so 
it just goes to syslog. But if you have you can handle the rotation in 
the syslog configuration in /etc/logrotate.d or if you prefer write you 
own config file.

Hope this clears the fog a little. (Un)fortunately we have a very 
flexible system where small changes on one end may have dependencies 
where you might not expect them. So check

- what services write logs and where
- do the logfiles need to be rotated
- are these logfiles referenced somewhere in the logrotate configuration

Find out which file grows unexpectedly fast. It might be a good idea to 
start there.

If you expect large log files I would be thinking about writing it to 
the SSD on your box (I guess you have a SSD on such a big box) to 
prevent losses on reboot or use syslog to write it to a remote loghost.

Cheers


ET


------------------------------------------------------------------------
leaf-user mailing list: [email protected]
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/