Comment 3 for bug 1958162

My current approach for frr is to change the syslog config to log to /var/log/frr.log, which our rsyslog can write to. If the user wants to use file logging instead of syslog, then that can be done by changing the default frr configuration to log to /var/log/frr/frr.log and it will also just work.

I added a /var/log/frr.log to the existing logrotate snippet, so that takes care of the (default) syslog case.

To make rsyslog log to /var/log/frr/frr.log requires a bigger delta with debian, also involving maintainer scripts. I might look into that too, check how it feels.

But I hit a small snag in the current approach, because apparently watchfrr *always* logs to syslog, independent of the configuration in frr.conf. I contacted upstream[1], and will check in one or two days if that's really on purpose or a bug.

1. https://frrouting.slack.com/archives/C4T714TAQ/p1654782531144459 (sorry, login required)