Set syslog size

device
1

I want to set some specific size for syslog in Ubuntu Core 16 so it will strict that much of size and moved to next file.
how??

2

either turn off rsyslog completely and silmply rely on journald:

snap set system service.rsyslog.disable=true

or if you want to keep rsyslog running, /etc/logrotate.d/rsyslog is writable/ediatble so you can modify the rotation/compression/etc …

the latter one is indeed only doable via a logged in user.

3

Thanks ogra,
i hv tried earlier to edit /etc/logrotate.d/rsyslog BUT it is only read-only.

First approach is good BUT I want enable syslog and keep rotating with specific size so if any other option please let me know…

Thank you.

4

damn … you are right … it used to be writable at some point but apparently is not anymore:

$ grep logrotate /etc/system-image/writable-paths 
/var/lib/logrotate                      auto                    persistent  none        none

so i fear disabling it is the only option … you could create a snap using the log-observe interface to pipe journald output to a file you rotate by a script/systemd timer or whatnot though …

5

yuup…Actually I don’t want to add new .yaml that’s why.

Thanks for your reply.

6

Hi…
Finally I disabled the syslog BUT how to disable message in /var/log/ ???

Thanks…

7

Hi…
How to disable message, kern in /var/log/ ???
is that any effect if size not specified or not disabled.
Thanks…

8

OK. I got it.

Through Disable syslog kern.log also disabled…

1 Like
9

exactly, all logfiles in there are created by rsyslog

10

Hello,

  1. I want to rotate my RSYSLOG file with specific size in MB BUT ,
    I have tried to edit /etc/logrotate.d/rsyslog But it will read only files so is there any way to forcefully edit or Any relevant files of logrotate.

Actually I have worried Because after sometimes (1 yr or later) device size is full so after that may be its behavior changes.

so please update me …

Thanks…

11

well, as we have worked out over the last 6 days in this discussion, the logrotate configuration is not changeable … if you are fearing that logs could fill your disk you have the opportunity to turn off rsyslog and instead use journald to do logging to files yourself via a snap reading from the log-observe interface…

repeating your initial question will not change any of these outcomes above.

also note that rsyslog has been removed from core completely for anything after core16.

12

yupp… so sorry

Thanks for your reply.