[CentOS] rsyslog / rotation, best practices

Thu Apr 5 20:50:32 UTC 2012
Bob Hoffman <bob at bobhoffman.com>

centos6
in regards to /etc/logrotate.d/syslog the file is in charge of processing
/var/log/cron
/var/log/maillog
/var/log/messages
/var/log/secure
/var/log/spooler

If I wanted to make a specific setting just for maillog (since that file 
gets huge really quick) would I add

1- a new file  /etc/logrotate.d/maillog with the parameters just like 
the other files

2- add parameters in the file it is already located in (/etc/log...d/syslog)

3- logrotate.conf where other settings for btmp and wtmp are located.

Which is the 'best practice' or preferred solution to changing the 
defaults for the files in the logrotate.d/syslog file.

Right now I have changed logrotate.conf to go off daily to keep the 
maillog from getting to huge. I do not know what the default is for size 
forcing the change, but when it got to 35MB logwatch was not properly 
accessing it and logrotate in debug mode was saying file too big must be 
config file.

There seems to be no setting for file size to force rotation for the log 
files in the logrotate.d/syslog file.

thanks
bob