0

So today I checked /var/log/syslog and apparently it got emptied earlier so that it was only very short. I'd like to find out why it was emptied and prevent it from getting cleared. Maybe there is also some way to restore them? Are these logs deleted automatically after they reach a certain length maybe?

I'm running a freshly installed Debian 9.1 with KDE.

2

The logs are being rotated by logrotate. You can check this in (likely root's) crontab. Additionally you can look into your logrotate.conf (/etc/logrotate.conf || /etc/logrotate.d/rsyslog) file to verify that the syslog messages are configured for rotation.

It should look like this:

/var/log/syslog {
    rotate 5
    weekly
    postrotate
        /usr/bin/killall -HUP syslogd
    endscript
}

This will append a ".#" to the end of the filename and move all files back one.

So if you had:

syslog
syslog.1
syslog.2

after logrotate you would have:

syslog
syslog.1
syslog.2
syslog.3

The syslog file will be the latest and the highest numbered file will be the oldest.

Logrotate man page: https://linux.die.net/man/8/logrotate

  • 1
    My Debian Jessie (heh) install seems to use rsyslogd, and the relevant logrotate conf is in /etc/logrotate.d/rsyslog. – sourcejedi Aug 4 '17 at 15:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.