====== Kamailio with Syslog and Log Rotate ======

<code>
Authors of initial tutorial:
Daniel-Constantin Mierla
  <miconda (at) gmail.com>

Elena-Ramona Modroiu
  <ramona (at) asipto.com>

</code>

How-to about configuring syslog daemon to write the log messages from Kamailio SIP server in a dedicated file and rotate it when becomes too big.

This tutorial is updated for Kamailio v3.2.0 or newer (original tutorial written for [[http://www.kamailio.org/dokuwiki/doku.php/tutorials:debug-syslog-messages|older versions is here]]).
===== Syslog - Custom Log File =====

In a Linux/Unix environment it is possible to configure syslog to write log messages to a separate file for a specific facility.

Also Kamailio can be configured to use a particular facility and therefore then make syslog to redirect that facility into a separate file. This can greatly improve the readability and manageability of Kamailio  logs.

The default syslog file depends on your OS distribution. For example, in Debian Linux is “/var/log/syslog” and in RedHat Linux is “/var/log/messages”. To make Kamailio print log messages in another file you have to follow the next instructions.

  * set option “log_facility=LOG_LOCAL0” in Kamailio configuration file (this is in the default Kamailio config)
  * then configure syslog to use a special file for log messages with facility “LOG_LOCAL0”

The configuration file of syslog can be usually found in “/etc/syslog.conf”. Next example, “Changes in syslog.conf” shows a syslog configuration file modified to report Kamailio error messages into a separate file.

Example: Changes in syslog.conf
<code>
...
#
# don't log messages with LOG_LOCAL0 in /var/log/syslog anymore
*.*;auth,authpriv.none,local0.none		-/var/log/syslog

#
# log messages with LOG_LOCAL0 in /var/log/kamailio.log
local0.*			-/var/log/kamailio.log
...
</code>

NOTE: The '-' in front of "/var/log/kamailio.log" is to omit synchronizing the log file after every log message. If you choose to configure “syslog” in synchronous mode you must be aware that it has big impact over performances when the signaling traffic is high.

===== Syslog-NG Configuration =====

If you are using **syslogn-ng**, one of the options you can add in its configuration file is:

<code>
destination local0 { file("/var/log/kamailio.log"); };
filter f_local0 { facility(local0); };
log { source(src); filter(f_local0); destination(local0); };
</code>

===== Log Rotate =====

When using **syslog** daemon, in most of current Linux distributions, you just have to add a file:

<code>
/etc/logrotate.d/kamailio 
</code>

Containing:

<code>
/var/log/kamailio.log {
    missingok
    size=50M
    create 0644 root root
    postrotate
	   /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
    endscript
}
</code>

Otherwise, add the piece of config above in **/etc/logrotate.conf**.

For **syslog-ng** the appropriate pid file has to be used, should be like:

<code>
/var/log/kamailio.log {
    missingok
    size=50M
    create 0644 root root
    postrotate
	   /bin/kill -HUP `cat /var/run/syslog-ng.pid 2> /dev/null` 2> /dev/null || true
    endscript
}
</code>

You can test the existence of pid files before using kill, like:

<code>
    if [ -f /var/run/syslog-ng.pid ]; then    \
        kill -HUP `cat /var/run/syslog-ng.pid`; \
    fi;
</code>


For **rsyslogd**:

<code>
/var/log/kamailio.log {
        daily
        missingok
        rotate 14
        compress
        delaycompress
        create 0644 root adm
        postrotate
                /usr/lib/rsyslog/rsyslog-rotate
        endscript
}
</code>