Remotely monitoring server activity

[Alan DeKok]

On Feb 20, 2019, at 3:09 AM, R3DNano <r3dnano at gmail.com> wrote:
> 
> Ok, I finally went ahead and successfully configured rsyslog to forward
> localX messages to a remote syslog server.
> The thing is that the files being logged to disk by the detailed log under
> /var/log/radiusd/radacct were taking a lot of space in my server. Because I
> had the remote syslog thingy working I just disabled this log to disk, now,
> there's noting being dumped to /var/log/radiusd/radacct.
> 
> However, now I have to forward accounting packets to another radius server
> and in the documentation (yeah, I've read (most of) it :) ) I see the
> copy-acct-to-home-server virtual server makes use of those log files....

  That virtual server uses the detail files as a backup in case the home server goes down.

> What should I do? - as far as i can understand, I should just suck it up
> and either enlarge the /var/log partition or just create some sort of
> external script that purges those files.... wat's the common practice for
> these cases?

  If you use the copy-acct-to-home-server virtual server, it will clean up those files as it reads them,

  If you're just dumping logs to /var/log/radiusd/radacct, there are "logrotate" scripts to clean them up after a period of time.

  The point of logs is *not* to keep them forever.  It's fine to clean them up if they're too old, or too large

  Alan DeKok.