Cleaning up default syslog configuration (Re: brainstorming for UDS-N - Performance - disk footprint)

[Michael Biebl]

As Debian maintainer of rsyslog, I'd like to chime in here:

On 01.11.2010 19:33, Steve Langasek wrote:
> 
> For the actual implementation, I propose this strawman:
> 
>  /var/log/auth.log: synchronous logging of anything related to
>    authentication; synchronous so that this maintains its current utility as
>    a potential audit log in the event of system crashes triggered by an

For some time [1], synchronous logging in rsyslog has been disabled and needs to
be turned on explicitly, i.e. the "-" has no effect, unless
$ActionFileEnableSync is set to "on".

So far, no one seems to have noticed, which makes me think it isn't a feature
desperately missed by anyone :-)

That said, if you need proper audit logs, there are better ways to accomplish
that and I wouldn't rely on rsyslog for that.


Aside that, I'd welcome efforts to remove duplication from the default syslog
configuration and hope we can agree on that across Debian and Ubuntu.

The current state of rsyslog.conf is merely the fact of copying over the old
syslog.conf from sysklogd verbatim.

Personally, I'd like to drop mail.{info,warn,err} and simply keep mail.log.
I'd also like to drop news.* and rely on the inn? package to ship a rsyslog snippet.

And most importantly, I'd like to clean up the syslog vs messages mess.
I never quite understood the reason for having those *two* log files.

Cheers,
Michael


[1] http://www.rsyslog.com/doc/v3compatibility.html "Output File Syncing"
-- 
Why is it that all of the instruments seeking intelligent life in the
universe are pointed away from Earth?

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 900 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-devel/attachments/20110113/89e7ee87/attachment-0001.pgp>