Linux Logs

rsyslog

• rsyslog (partially) controls where services write their logs.
• /etc/rsyslog.conf controls where services output their messages.
• Messages are categorized by type. For example, error, warning, etc
• rsyslog can forward logs to other servers and receive logs from other servers

Log Files

logrotate

• /etc/logrotate.conf is the config file for logrotate.
• There is an import by default for all files in /etc/logrotate.d/.
• Settings can be applied per log file. Syntax:

/var/log/yum.log {
	missingok                 # it's okay for the file to be missing
	notifempty                # don't rotate if the file is empty
	maxsize 30k               # only rotate if the file is at least this size
	yearly                    # time period for rotation
	create 0600 root root     # owners/permissions
}

systemd-journald

• journald is not persistent by default.
• The journal is binary rather than text.

Make the journal persistent

mkdir /var/log/journal
chgrp systemd-journal /var/log/journal
chmod 2775 /var/log/journal
systemctl restart systemd-journal.service

Commands