Set syslog size


#1

I want to set some specific size for syslog in Ubuntu Core 16 so it will strict that much of size and moved to next file.
how??


#2

either turn off rsyslog completely and silmply rely on journald:

snap set system service.rsyslog.disable=true

or if you want to keep rsyslog running, /etc/logrotate.d/rsyslog is writable/ediatble so you can modify the rotation/compression/etc …

the latter one is indeed only doable via a logged in user.


#3

Thanks ogra,
i hv tried earlier to edit /etc/logrotate.d/rsyslog BUT it is only read-only.

First approach is good BUT I want enable syslog and keep rotating with specific size so if any other option please let me know…

Thank you.


#4

damn … you are right … it used to be writable at some point but apparently is not anymore:

$ grep logrotate /etc/system-image/writable-paths 
/var/lib/logrotate                      auto                    persistent  none        none

so i fear disabling it is the only option … you could create a snap using the log-observe interface to pipe journald output to a file you rotate by a script/systemd timer or whatnot though …


#5

yuup…Actually I don’t want to add new .yaml that’s why.

Thanks for your reply.


#6

Hi…
Finally I disabled the syslog BUT how to disable message in /var/log/ ???

Thanks…


#7

Hi…
How to disable message, kern in /var/log/ ???
is that any effect if size not specified or not disabled.
Thanks…


#8

OK. I got it.

Through Disable syslog kern.log also disabled…


#9

exactly, all logfiles in there are created by rsyslog


#10

Hello,

  1. I want to rotate my RSYSLOG file with specific size in MB BUT ,
    I have tried to edit /etc/logrotate.d/rsyslog But it will read only files so is there any way to forcefully edit or Any relevant files of logrotate.

Actually I have worried Because after sometimes (1 yr or later) device size is full so after that may be its behavior changes.

so please update me …

Thanks…


#11

well, as we have worked out over the last 6 days in this discussion, the logrotate configuration is not changeable … if you are fearing that logs could fill your disk you have the opportunity to turn off rsyslog and instead use journald to do logging to files yourself via a snap reading from the log-observe interface…

repeating your initial question will not change any of these outcomes above.

also note that rsyslog has been removed from core completely for anything after core16.


#12

yupp… so sorry

Thanks for your reply.