| View previous topic :: View next topic |
| Author |
Message |
Peach
Advocate
Joined: 08 Mar 2003
Posts: 3686
Location: London, UK
|
 Posted: Tue Mar 21, 2006 10:02 am Post subject: [syslog-ng] logging di postfix e logrotate [RISOLTO] |
 |
|
Salve a tutti.
C'è una cosa che mi cruccia in questi giorni: dopo aver installato postfix e creato un accettabile sistema di posta virtuale mi sono reso conto che tutti i messaggi di postfix di processing della posta vengono sbattuti in /var/log/messages . Da quello che ho letto in giro per il forum sembrerebbe che syslog usi svariati file di log ...che non ho.
Ora se qualcuno mi sa dire dove mettere le mani prima che messages diventi di svariati milioni di mega gliene sarei grato.
PS: ammetto di non aver indagato, ma logrotate una volta emerso va da solo???? altrimenti è il caso che spenda qualche ora di sonno a cercare come farlo andare 
_________________
Gentoo user since 2004.
"It's all fun and games, until someone loses an eye" - mom
Last edited by Peach on Tue Mar 21, 2006 7:35 pm; edited 1 time in total |
|
| Back to top |
|
 |
pava_rulez
Guru
Joined: 02 Mar 2005
Posts: 339
Location: Bologna -> Italy -> Europe
|
| Posted: Tue Mar 21, 2006 10:20 am Post subject: |
|
|
Io ho questa situazione:
| Code: | vim /etc/logrotate.d/amavisd-new
/var/log/amavis.log {
compress
dateext
maxage 365
rotate 3
missingok
notifempty
size +4096k
create 644 root root
sharedscripts
prerotate
/etc/init.d/amavisd stop
endscript
postrotate
sleep 3
/etc/init.d/amavisd start
endscript
}
|
| Code: | vim /etc/cron.daily/logrotate.cron
#! /bin/sh
/usr/sbin/logrotate /etc/logrotate.conf
|
| Code: | vim /etc/syslog-ng/syslog-ng.conf
# /etc/syslog-ng/syslog-ng.conf
# From the Gentoo Linux Security Guide
# http://www.gentoo.org/doc/en/gentoo-security.xml
# Creative Commons - Attribution / Share Alike License
# http://creativecommons.org/licenses/by-sa/2.0
options { long_hostnames(off); sync(0); };
#source where to read log
source src { unix-stream("/dev/log"); internal(); };
source kernsrc { file("/proc/kmsg"); };
#define destinations
destination authlog { file("/var/log/auth.log"); };
destination syslog { file("/var/log/syslog"); };
destination cron { file("/var/log/cron.log"); };
destination daemon { file("/var/log/daemon.log"); };
destination kern { file("/var/log/kern.log"); };
destination lpr { file("/var/log/lpr.log"); };
destination user { file("/var/log/user.log"); };
destination mail { file("/var/log/mail.log"); };
destination mailinfo { file("/var/log/mail.info"); };
destination mailwarn { file("/var/log/mail.warn"); };
destination mailerr { file("/var/log/mail.err"); };
destination newscrit { file("/var/log/news/news.crit"); };
destination newserr { file("/var/log/news/news.err"); };
destination newsnotice { file("/var/log/news/news.notice"); };
destination debug { file("/var/log/debug"); };
destination messages { file("/var/log/messages"); };
destination console { usertty("root"); };
destination console_all { file("/dev/tty12"); };
destination xconsole { pipe("/dev/xconsole"); };
#create filters
filter f_auth { facility(auth); };
filter f_authpriv { facility(auth, authpriv); };
filter f_syslog { not facility(authpriv, mail); };
filter f_cron { facility(cron); };
filter f_daemon { facility(daemon); };
filter f_kern { facility(kern); };
filter f_lpr { facility(lpr); };
filter f_mail { facility(mail); };
filter f_user { facility(user); };
filter f_debug { not facility(auth, authpriv, news, mail); };
filter f_messages { level(info..warn)
and not facility(auth, authpriv, mail, news); };
filter f_emergency { level(emerg); };
filter f_info { level(info); };
filter f_notice { level(notice); };
filter f_warn { level(warn); };
filter f_crit { level(crit); };
filter f_err { level(err); };
filter f_failed { match("failed"); };
filter f_denied { match("denied"); };
#connect filter and destination
log { source(src); filter(f_authpriv); destination(authlog); };
log { source(src); filter(f_syslog); destination(syslog); };
log { source(src); filter(f_cron); destination(cron); };
log { source(src); filter(f_daemon); destination(daemon); };
log { source(kernsrc); filter(f_kern); destination(kern); };
log { source(src); filter(f_lpr); destination(lpr); };
log { source(src); filter(f_mail); destination(mail); };
log { source(src); filter(f_user); destination(user); };
log { source(src); filter(f_mail); filter(f_info); destination(mailinfo); };
log { source(src); filter(f_mail); filter(f_warn); destination(mailwarn); };
log { source(src); filter(f_mail); filter(f_err); destination(mailerr); };
log { source(src); filter(f_debug); destination(debug); };
log { source(src); filter(f_messages); destination(messages); };
log { source(src); filter(f_emergency); destination(console); };
#default log
log { source(src); destination(console_all); };
|
| Code: | ls /var/log
Orione ~ # ls /var/log/
total 199M
drwxr-xr-x 13 root root 4.0K Mar 21 03:10 .
drwxr-xr-x 18 root root 4.0K Feb 22 10:50 ..
-rw-r--r-- 1 amavis root 3.9M Mar 21 11:20 amavis.log
-rw-r--r-- 1 amavis root 4.5M Sep 15 2005 amavis.log-20050915
-rw-r--r-- 1 amavis root 630K Feb 4 03:10 amavis.log-20060204.gz
-rw-r--r-- 1 amavis root 661K Feb 22 03:10 amavis.log-20060222.gz
-rw-r--r-- 1 amavis root 688K Mar 10 03:10 amavis.log-20060310.gz
drwxr-xr-x 2 root root 4.0K Mar 19 03:10 apache
drwxr-xr-x 2 apache apache 4.0K Jul 28 2005 apache2
-rw-r--r-- 1 root root 9.5K Mar 20 18:32 apcupsd.events
-rw------- 1 root root 37M Mar 21 11:13 auth.log
drwxr-xr-x 2 clamav clamav 4.0K Feb 22 09:26 clamav
-rw------- 1 root root 4.7M Mar 21 11:20 cron.log
drwxr-xr-x 2 root root 4.0K Jul 13 2005 cups
-rw------- 1 root root 40M Mar 21 11:20 daemon.log
drwxr-xr-x 2 root root 4.0K Jul 13 2005 dcc
-rw------- 1 root root 49M Mar 21 11:20 debug
-rw-r----- 1 root root 9.2K Mar 20 18:26 dmesg
-rw-rw---- 1 portage portage 255K Mar 21 10:04 emerge.log
-rw------- 1 root root 2.3K Jan 24 17:09 jftpgw.xferlog
-rw------- 1 root root 43M Mar 21 11:18 kern.log
-rw-r--r-- 1 root root 294K Mar 21 09:40 lastlog
-rw------- 1 root root 22K Mar 14 23:58 mail.err
-rw------- 1 root root 2.2M Mar 21 11:20 mail.info
-rw------- 1 root root 577K Mar 21 03:10 mail.info.1.gz
-rw------- 1 root root 36K Mar 20 03:10 mail.info.2.gz
-rw------- 1 root root 36K Mar 19 03:10 mail.info.3.gz
-rw------- 1 root root 137K Mar 18 03:10 mail.info.4.gz
-rw------- 1 root root 2.2M Mar 21 11:20 mail.log
-rw------- 1 root root 578K Mar 21 03:10 mail.log.1.gz
-rw------- 1 root root 216K Mar 13 03:10 mail.log.2
-rw------- 1 root root 36K Mar 20 03:10 mail.log.2.gz
-rw------- 1 root root 241K Mar 12 03:10 mail.log.3
-rw------- 1 root root 36K Mar 19 03:10 mail.log.3.gz
-rw------- 1 root root 1.3M Mar 11 03:10 mail.log.4
-rw------- 1 root root 137K Mar 18 03:10 mail.log.4.gz
-rw------- 1 root root 14 Jan 4 16:28 mail.log.offset
-rw-r----- 1 root adm 0 Mar 21 03:10 mail.warn
-rw------- 1 root root 275 Mar 21 03:10 mail.warn.1.gz
-rw-r----- 1 root adm 20 Mar 20 03:10 mail.warn.2.gz
-rw-r----- 1 root adm 20 Mar 19 03:10 mail.warn.3.gz
-rw-r----- 1 root adm 20 Mar 18 03:10 mail.warn.4.gz
-rw------- 1 root root 152K Mar 21 11:20 messages
-rw------- 1 root root 42K Mar 19 03:10 messages.1.gz
-rw------- 1 root root 40K Mar 12 03:10 messages.2.gz
-rw------- 1 root root 37K Mar 5 03:10 messages.3.gz
-rw------- 1 root root 34K Feb 26 03:10 messages.4.gz
-rw------- 1 root root 13 Jan 4 16:22 messages.offset
drwxr-x--- 2 mysql mysql 4.0K Mar 10 15:40 mysql
drwxr-xr-x 2 root root 4.0K Mar 10 2005 news
-rw-r--r-- 1 root root 5.6K Oct 2 20:46 ntpd.log
drwxr-xr-x 2 root root 4.0K Mar 13 03:00 samba
drwxrwx--- 2 root portage 4.0K Jan 3 11:38 sandbox
drwxr-xr-x 2 squid squid 4.0K Mar 18 04:26 squid
drwxr-xr-x 2 squid squid 4.0K Mar 10 15:14 squidGuard
-rw------- 1 root root 415K Mar 21 11:20 syslog
-rw------- 1 root root 189K Mar 19 03:10 syslog.1.gz
-rw------- 1 root root 2.1M Feb 19 03:10 syslog.2
-rw------- 1 root root 171K Mar 12 03:10 syslog.2.gz
-rw------- 1 root root 1.7M Feb 12 03:10 syslog.3
-rw------- 1 root root 148K Mar 5 03:10 syslog.3.gz
-rw------- 1 root root 1.5M Feb 5 03:10 syslog.4
-rw------- 1 root root 13 Jan 4 18:00 syslog.offset
-rw------- 1 root root 1.4M Mar 21 10:38 user.log
-rw-rw-r-- 1 root utmp 71K Mar 21 09:40 wtmp
-rw-rw-r-- 1 root utmp 2.3K Mar 1 03:10 wtmp.1.gz
-rw-r--r-- 1 root root 19K Nov 25 12:39 xferlog
|
Spero di esserti stato utile... 
_________________
Is this the Real Life?
is this just Fantasy?
caught in a landslide
no escape from Reality... |
|
| Back to top |
|
|
makoomba
Bodhisattva
Joined: 03 Jun 2004
Posts: 1856
|
| Posted: Tue Mar 21, 2006 10:30 am Post subject: |
|
|
questo il mio
| Code: | destination auth { file("/var/log/auth.log"); };
destination cron { file("/var/log/cron.log"); };
destination mail { file("/var/log/mail.log"); };
destination mailclient { file("/var/log/mailclient.log"); };
destination ftp { file("/var/log/ftp.log"); };
destination debug { file("/var/log/debug.log"); };
destination messages { file("/var/log/messages"); };
destination console { usertty("root"); };
filter auth { facility(auth, authpriv) and not level(debug); };
filter cron { facility(cron) and not level(debug); };
filter mailclient { not level(debug) and (match("pop3d") or match ("imap")); };
filter mail { facility(mail) and not level(debug) and not filter(mailclient); };
filter ftp { facility(ftp) and not level(debug); };
filter debug { level(debug); };
filter messages { not (level(debug) or filter(auth) or filter(cron) or filter(ftp) or filter(mail) or filter(mailclient)); };
filter crit { level(crit .. emerg); };
log { source(src); filter(auth); destination(auth); };
log { source(src); filter(cron); destination(cron); };
log { source(src); filter(ftp); destination(ftp); };
log { source(src); filter(mail); destination(mail); };
log { source(src); filter(mailclient); destination(mailclient); };
log { source(src); filter(debug); destination(debug); };
log { source(src); filter(messages); destination(messages); };
|
| Code: | mail ~ # cat /etc/logrotate.d/syslog-ng
# $Header: /var/cvsroot/gentoo-x86/app-admin/syslog-ng/files/syslog-ng.logrotate,v 1.2 2004/07/18 02:25:02 dragonheart Exp $
#
# Syslog-ng logrotate snippet for Gentoo Linux
# contributed by Michael Sterrett
#
/var/log/messages /var/log/auth.log /var/log/cron.log /var/log/mail.log /var/log/mailclient.log /var/log/ftp.log {
compress
weekly
rotate 7
dateext
sharedscripts
postrotate
/etc/init.d/syslog-ng reload > /dev/null 2>&1 || true
endscript
}
|
_________________
When all else fails, read the instructions. |
|
| Back to top |
|
|
Ilvalle
Guru
Joined: 07 Mar 2005
Posts: 325
Location: Gallarate - ITALY
|
| Posted: Tue Mar 21, 2006 2:55 pm Post subject: |
|
|
Le configurazioni precedenti sono molto esaurienti.
Ricordati di non inserire i log gia' filtrati in messages
di modo da non avere ridondanza.
senza postare tutto io syslog io ho fatto questo.
| Code: |
filter f_messages { not match("ssh") and not match("kern") and not match("cron") and not match("dhcp") and not match("ddclient") and not match("(password|login|authentication).+(fail|invalid)") and not match("([Ff]ailed|[Ii]nvalid).+(password|login|authentication)") and not match("ILLEGAL ROOT LOGIN") and not match ("NFS") and not match("Authentication failure") and not match("cvs") and not match("aiccu") and not match("smb") and not match("nmbd") and not match("syslog-ng") and not match("rpc") and not match("denyhosts") and not match("reiser"); };
|
tutti questi son gia' sistemati in altri log.
paolo |
|
| Back to top |
|
|
Peach
Advocate
Joined: 08 Mar 2003
Posts: 3686
Location: London, UK
|
| Posted: Tue Mar 21, 2006 7:26 pm Post subject: |
|
|
veramente grazie a tutti quanti per la chiarezza (o grazie a syslog per la chiarezza e semplicità della sintassi?) 
ora ho sistemato così:
| Code: | # DESTINATIONS
destination auth { file("/var/log/auth.log"); };
destination cron { file("/var/log/cron.log"); };
destination mail { file("/var/log/mail.log"); };
destination mailinfo { file("/var/log/mail.info.log"); };
destination mailwarn { file("/var/log/mail.warn.log"); };
destination mailerr { file("/var/log/mail.err.log"); };
destination debug { file("/var/log/debug.log"); };
destination messages { file("/var/log/messages"); };
destination console { usertty("root"); };
destination console_all { file("/dev/tty12"); };
# FILTERS
filter auth { facility(auth, authpriv) and not level(debug); };
filter cron { facility(cron) and not level(debug); };
filter mail { facility(mail) and not level(debug); };
filter mail_i { facility(mail) and level(info) and not level(debug); };
filter mail_w { facility(mail) and level(warn) and not level(debug); };
filter mail_e { facility(mail) and level(err) and not level(debug); };
filter debug { level(debug); };
filter messages { not (level(debug) or filter(auth) or filter(cron) or filter(mail) or filter(mail_i) or filter(mail_w) or filter(mail_e)); };
# LOG = FILTER + DESTINATION
log { source(src); filter(auth); destination(auth); };
log { source(src); filter(cron); destination(cron); };
log { source(src); filter(mail); destination(mail); };
log { source(src); filter(mail_i); destination(mailinfo); };
log { source(src); filter(mail_w); destination(mailwarn); };
log { source(src); filter(mail_e); destination(mailerr); };
log { source(src); filter(debug); destination(debug); };
log { source(src); filter(messages); destination(messages); };
log { source(src); destination(console_all); }; |
| Code: | /var/log/messages /var/log/auth.log /var/log/cron.log /var/log/mail.log /var/log/mail.info.log /var/log/mail.warn.log /var/log/mail.err.log {
compress
weekley
rotate 7
dateext
sharedscripts
postrotate
/etc/init.d/syslog-ng reload > /dev/null 2>&1 || true
endscript
} |
mi domandavo.. mi basta riavviare syslog-ng perchè i file di log vengano creati e si inizi il processo di logging corretto? oppure dovrei riavviare anche qualche altro servizio???
_________________
Gentoo user since 2004.
"It's all fun and games, until someone loses an eye" - mom |
|
| Back to top |
|
|
makoomba
Bodhisattva
Joined: 03 Jun 2004
Posts: 1856
|
| Posted: Tue Mar 21, 2006 7:31 pm Post subject: |
|
|
per quanto riguarda i logs di syslog-ng, non devi fare altro.
_________________
When all else fails, read the instructions. |
|
| Back to top |
|
|
Peach
Advocate
Joined: 08 Mar 2003
Posts: 3686
Location: London, UK
|
| Posted: Tue Mar 21, 2006 7:35 pm Post subject: [risolto] |
|
|
| makoomba wrote: | | per quanto riguarda i logs di syslog-ng, non devi fare altro. |
perfetto, grazie ancora
_________________
Gentoo user since 2004.
"It's all fun and games, until someone loses an eye" - mom |
|
| Back to top |
|
|
|
Forum italiano (Italian)
