Rsyslog

TIPS

Ne pas faire logguer postfix dans syslog en plus de mail.log, ainsi que virer cron de syslog

1
*.*;mail.none;mail.error;auth,cron,authpriv.none             -/var/log/syslog

Disable mail.info qui double mail.log

1
2
3
#mail.info                      -/var/log/mail.info
#mail.warn                      -/var/log/mail.warn
#mail.err                       /var/log/mail.err

1
cron.*                          /var/log/cron.log
  • En cas d’erreur 
1
Apr 11 16:17:46 myserver rsyslogd-2177: imuxsock lost 99 messages from pid 3607 due to rate-limiting
1
2
root@myserver/:# vi /etc/rsyslog.conf
$SystemLogRateLimitInterval 0 # turn off rate limiting
  • Le signe “-“ :
    You may prefix each entry with the minus ``-‘’ sign to omit syncing the file after every logging. Note that you might lose information if the system crashes right behind a write attempt. Nevertheless this might give you back some performance, especially if you run programs that use logging in a very verbose manner.

L ami logger

1
# echo "test" | logger -s -p auth.notice -t youpee
<37>Oct 28 15:41:08 youpee: test
# tail -1 /var/log/auth.log
Oct 28 15:41:08 thcol-exp-logs-01 youpee: test