Zimbra logs permanence

[jbermudez]

Hello,

i need to change zimbra logs permanence 8 to 365

i have already change crontab file:

30 2 * * * find /opt/zimbra/log/ -type f -name \*.log\* -mtime +8 -exec rm {} \; > /dev/null 2>&1
35 2 * * * find /opt/zimbra/log/ -type f -name \*.out.???????????? -mtime +8 -ex ec rm {} \; > /dev/null 2>&1

to

30 2 * * * find /opt/zimbra/log/ -type f -name \*.log\* -mtime +365 -exec rm {} \; > /dev/null 2>&1
35 2 * * * find /opt/zimbra/log/ -type f -name \*.out.???????????? -mtime +365 -ex ec rm {} \; > /dev/null 2>&1


Need to change something else?

Thanks

[phoenix]

Originally Posted by jbermudez

i need to change zimbra logs permanence 8 to 365

You really don't want to do that unless you have plenty of HD space, the files can get rather large and any errors in the log levels may fill up your HD space with the possibility of taking your server down. I'd suggest you set-up a separate syslog server (Splunk has a free version) and send the files to that.

[jbermudez]

Originally Posted by phoenix

You really don't want to do that unless you have plenty of HD space, the files can get rather large and any errors in the log levels may fill up your HD space with the possibility of taking your server down. I'd suggest you set-up a separate syslog server (Splunk has a free version) and send the files to that.

A law requires us to keep the log for 1 year

[phoenix]

Originally Posted by jbermudez

A law requires us to keep the log for 1 year

Yes and you can keep them for as long as you like on a syslog server.

[jbermudez]

Thanks, I will study this option. But if I decide to leave it, should I change any file more?

[jbermudez]

i found something more.

in /etc/logrotate.d/zimbra

/var/log/zimbra.log {
daily
missingok
notifempty
create 0644 zimbra zimbra
postrotate
kill -HUP `cat /var/run/syslog*.pid 2> /dev/null` 2> /dev/null || true
su - zimbra -c "/opt/zimbra/bin/zmswatchctl restart" > /dev/null 2>&1 || true
endscript
compress
}

-rw-r--r--. 1 zimbra zimbra 1111362 Sep 3 03:10 zimbra.log-20110903.gz
-rw-r--r--. 1 zimbra zimbra 749125 Sep 4 03:16 zimbra.log-20110904.gz
-rw-r--r--. 1 zimbra zimbra 661842 Sep 5 03:20 zimbra.log-20110905.gz


How can i keep those compressed files 365 days?