Hi,
I have been trying to configure log rotation for the OS version Solaris 10, however it is not working.
In Linux, these would be the parameters :
rotate 4
missingok
notifempty
compress
size 15M
create 0644 root root
To do the same in Solaris, I am not sure of the exact parameters to use to match the ones above, but the basic configuration I did was :
# vi /etc/logadm.conf
#### SIEM logs #####
/var/log/dbaudit.log -C 4 -s 15m
However, after I restart syslog :
# svcadm restart system/system-log
I still do not see dbaudit.log generated in /var/log. All the logging goes to audit.log. How do I prevent this, and instead make the logs generate in dbaudit.log?
I want to force logrotation to see if it works :
# logadm -p now /var/log/dbaudit.log
But if the log is not even there, how do I logrotate?
This is the syslog.conf file :
root@edms # less /etc/syslog.conf
#ident "@(#)syslog.conf 1.5 98/12/14 SMI" /* SunOS 5.0 */
#
# Copyright (c) 1991-1998 by Sun Microsystems, Inc.
# All rights reserved.
#
# syslog configuration file.
#
# This file is processed by m4 so be careful to quote (`') names
# that match m4 reserved words. Also, within ifdef's, arguments
# containing commas must be quoted.
#
*.err;kern.notice;auth.notice /dev/sysmsg
*.err;auth.info;kern.debug;daemon.notice;mail.crit /var/adm/messages
*.alert;kern.err;daemon.err operator
*.alert root
local1.warn /var/log/audit.log
local1.warning /var/log/dbaudit.log
*.info;auth.info @loghost
*.emerg *
# if a non-loghost machine chooses to have authentication messages
# sent to the loghost machine, un-comment out the following line:
#auth.notice ifdef(`LOGHOST', /var/log/authlog, @loghost)
mail.debug ifdef(`LOGHOST', /var/log/syslog, @loghost)
#
# non-loghost machines will use the following lines to cause "user"
# log messages to be logged locally.
#
ifdef(`LOGHOST', ,
user.err /dev/sysmsg
user.err /var/adm/messages
user.alert `root, operator'
user.emerg *
)
############# SIEM testing purpose ###################
. @10.89.4.233
######################################################
(END)