SEM-Force a Manual Log Rotation in the SEM Appliance

2/28/2020 11:54 PM

5/24/2022 5:18 AM

This is a way to force log Rotation in the SEM Appliance
This will verify that syslog-ng is able to rotate the the syslog files
 
 

Security Event Manager

Logs aren't rotating and you want to make sure that the syslog-ng log rotation is working. 
 

You can manually rotate the logs using the following commands:
logrotate --force /etc/logrotate.d/external

This command will rotate the following logs 
/var/log/clock2.log
/var/log/cron.log
/var/log/daemon.log
/var/log/ftp.log
/var/log/kern.log
/var/log/local[0-7].log
/var/log/lpr.log
/var/log/mail.log
/var/log/news.log
/var/log/ntp.log
/var/log/syslog.log
/var/log/user.log
/var/log/uucp.log {
  

You can see which templates syslog-ng uses rotate logs- For example; lem will rotate all SEM related logs 




This command logrotate --force /etc/logrotate.d/lem rotates the internal SEM logs

See below:

/usr/local/contego/cli-client.log
/usr/local/contego/hsql.log
/usr/local/contego/manager.log
/usr/local/contego/run/smac.log
/usr/local/contego/run/smac-hist.log
/usr/local/contego/run/tomcat/logs/access.*.log
/usr/local/contego/run/rawsearch-tomcat/logs/access.*.log
/var/log/lem/rawsearch*.log