Mailing List Archive

Hi Johnn,

the typical solution seems to be to include a date-specific part in the
filename:

/var/log/rsyslog/%$YEAR%/%$MONTH%/%$DAY%/%HOSTNAME%

And clean up the directories every now and then...

Rainer

> -----Original Message-----
> From: rsyslog-bounces at lists.adiscon.com [mailto:rsyslog-
> bounces at lists.adiscon.com] On Behalf Of Johnny Tan
> Sent: Thursday, March 27, 2008 2:29 AM
> To: rsyslog-users
> Subject: [rsyslog] central logserver log rotation
>
> Thanks to Rainer, I've got my shiny new central log server
> up & running. I'd like to rotate the logs on there.
>
> If I've got a separate directory for each host, though
> (i.e., /var/log/rsyslog/%HOSTNAME%), how can I do this?
>
> Does something like this work with logrotate:
>
> /var/log/rsyslog/*/* {
> weekly
> notifempty
> missingok
> }
>
>
> What are people doing for logrotation on their CENTRAL
> logging server?
>
> johnn
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog

On 2008-03-27, Rainer Gerhards <rgerhards at hq.adiscon.com> wrote:
> the typical solution seems to be to include a date-specific part in the
> filename:
>
> /var/log/rsyslog/%$YEAR%/%$MONTH%/%$DAY%/%HOSTNAME%
>
> And clean up the directories every now and then...

/etc/rsyslog.conf:

#####################################################
# Log everything to a per host daily logfile #
#####################################################
$template DailyPerHostLogs,"/var/log/syslog/%$YEAR%/%$MONTH%/%$DAY%/%HOSTNAME%/messages.log"
*.* -?DailyPerHostLogs

/etc/cron.hourly/syslog-bzip2:

find /var/log/syslog/2008 -type f -mtime +1 -name "*.log" -exec bzip2 '{}' \;



-jf

Hi JF,

thanks, I've made a wiki page out of it:

http://wiki.rsyslog.com/index.php/DailyLogRotation

Rainer

> -----Original Message-----
> From: rsyslog-bounces at lists.adiscon.com [mailto:rsyslog-
> bounces at lists.adiscon.com] On Behalf Of Jan-Frode Myklebust
> Sent: Friday, March 28, 2008 8:51 AM
> To: rsyslog at lists.adiscon.com
> Subject: Re: [rsyslog] central logserver log rotation
>
> On 2008-03-27, Rainer Gerhards <rgerhards at hq.adiscon.com> wrote:
> > the typical solution seems to be to include a date-specific part in
> the
> > filename:
> >
> > /var/log/rsyslog/%$YEAR%/%$MONTH%/%$DAY%/%HOSTNAME%
> >
> > And clean up the directories every now and then...
>
> /etc/rsyslog.conf:
>
> #####################################################
> # Log everything to a per host daily logfile #
> #####################################################
> $template
>
DailyPerHostLogs,"/var/log/syslog/%$YEAR%/%$MONTH%/%$DAY%/%HOSTNAME%/me
> ssages.log"
> *.* -?DailyPerHostLogs
>
> /etc/cron.hourly/syslog-bzip2:
>
> find /var/log/syslog/2008 -type f -mtime +1 -name "*.log" -exec
> bzip2 '{}' \;
>
>
>
> -jf
>
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog

Jan-Frode Myklebust wrote:
> /etc/rsyslog.conf:
>
> #####################################################
> # Log everything to a per host daily logfile #
> #####################################################
> $template DailyPerHostLogs,"/var/log/syslog/%$YEAR%/%$MONTH%/%$DAY%/%HOSTNAME%/messages.log"
> *.* -?DailyPerHostLogs
>
> /etc/cron.hourly/syslog-bzip2:
>
> find /var/log/syslog/2008 -type f -mtime +1 -name "*.log" -exec bzip2 '{}' \;

Thanks for the example. And ... I was just thinking of doing
some gzip/bzip on my morning commute today, so your cron
example comes just in time too :).

johnn

In the long term (think tank!) it may be possible do some automagic with
dynafiles. Let's say specify a timeout after which, when no longer
accessed, some (external) rotation logic is invoked. The good thing,
probably, would be that rsyslog knows best when it can and need to do
so. It could even invoke it somewhat quicker if it runs out of disk
space ;)

Again, nothing to be implemented soon, but if you have an opinion on it,
I'd like to hear about it.

Side-Note: we are getting close to an initial release of the web
interface. It will not only work with databases, but also with text
files. I have this, too, on my mind when I think about rotation...

Rainer

> -----Original Message-----
> From: rsyslog-bounces at lists.adiscon.com [mailto:rsyslog-
> bounces at lists.adiscon.com] On Behalf Of Johnny Tan
> Sent: Friday, March 28, 2008 4:07 PM
> To: rsyslog-users
> Subject: Re: [rsyslog] central logserver log rotation
>
> Jan-Frode Myklebust wrote:
> > /etc/rsyslog.conf:
> >
> > #####################################################
> > # Log everything to a per host daily logfile #
> > #####################################################
> > $template
>
DailyPerHostLogs,"/var/log/syslog/%$YEAR%/%$MONTH%/%$DAY%/%HOSTNAME%/me
> ssages.log"
> > *.* -?DailyPerHostLogs
> >
> > /etc/cron.hourly/syslog-bzip2:
> >
> > find /var/log/syslog/2008 -type f -mtime +1 -name "*.log" -exec
> bzip2 '{}' \;
>
> Thanks for the example. And ... I was just thinking of doing
> some gzip/bzip on my morning commute today, so your cron
> example comes just in time too :).
>
> johnn
> _______________________________________________
> rsyslog mailing list
> http://lists.adiscon.net/mailman/listinfo/rsyslog