<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link="#0563C1" vlink="#954F72"><div class=WordSection1><p>CLASSIFICATION: UNCLASSIFIED<o:p></o:p></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>Hello,<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>So I updated configuration to have following in my conf file:<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal>destination syslog { file("/var/log/syslog-${YEAR}-${MONTH}-${DAY}.log"); };<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>and syslog-ng restarted file,<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>But now I see 2 log files in /var/log<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Syslog.log<o:p></o:p></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>syslog-{YEAR}-{MONTH}-{DAY}.log<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>Not sure why it’s creating syslog-{YEAR}-{MONTH}-{DAY}.log named file versus actually putting day/month/year in file name. Anything I missed??<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>Thanks<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>Jitesh Amin<o:p></o:p></span></p><p>CLASSIFICATION: UNCLASSIFIED<o:p></o:p></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><a name="_____replyseparator"></a><b><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'>From:</span></b><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'> syslog-ng <syslog-ng-bounces@lists.balabit.hu> <b>On Behalf Of </b>Scheidler, Balázs<br><b>Sent:</b> Wednesday, May 30, 2018 8:03 AM<br><b>To:</b> Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu><br><b>Subject:</b> Re: [syslog-ng] (U) [Non-DoD Source] Re: Rotate syslog-ng log files<o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal style='margin-bottom:12.0pt'>All active links contained in this email were disabled. Please verify the identity of the sender, and confirm the authenticity of all links contained within the message prior to copying and pasting the address to a Web browser. <o:p></o:p></p><div class=MsoNormal align=center style='text-align:center'><hr size=2 width="100%" align=center></div><p class=MsoNormal style='margin-bottom:12.0pt'><o:p> </o:p></p><div><p class=MsoNormal>Yep, that would give you one logfile every day. It will not care about whether it reached 500mb though. But on the plus side that gives you a trivial way to identify which file holds a specific date, which is pretty cumbersome otherwise.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal>On May 30, 2018 07:52, "Amin, Jitesh CTR DISA JSP (US)" <jitesh.amin.ctr@mail.mil < Caution-mailto:jitesh.amin.ctr@mail.mil > > wrote:<o:p></o:p></p><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in'><p class=MsoNormal style='margin-bottom:12.0pt'>CLASSIFICATION: UNCLASSIFIED<br>Hello,<br>So here's what currently is configured in our .conf file:<br><br>destination syslog { file("/var/log/syslog.log" perm(0644)); };<br><br>what you are saying, is if I want logs to rotate on daily basis, I can just make the above line to read as following:<br><br>destination syslog { file("/var/log/syslog-${YEAR}-${MONTH}-${DAY}.log"); };<br><br><br>Thanks<br>Jitesh Amin<br><br><br>CLASSIFICATION: UNCLASSIFIED<br><br>-----Original Message-----<br>From: Gergely Nagy <algernon@balabit.com < Caution-mailto:algernon@balabit.com > > <br>Sent: Wednesday, May 30, 2018 7:25 AM<br>To: Amin, Jitesh CTR DISA JSP (US) <jitesh.amin.ctr@mail.mil < Caution-mailto:jitesh.amin.ctr@mail.mil > >; syslog-ng@lists.balabit.hu < Caution-mailto:syslog-ng@lists.balabit.hu > <br>Subject: [Non-DoD Source] Re: [syslog-ng] (U) Rotate syslog-ng log files<br><br>All active links contained in this email were disabled. Please verify the identity of the sender, and confirm the authenticity of all links contained within the message prior to copying and pasting the address to a Web browser. <br><br><br><br><br>----<br><br>Hi!<br><br>>>>>> "Amin" == Amin, Jitesh CTR DISA JSP (US) <jitesh.amin.ctr@mail.mil < Caution-mailto:jitesh.amin.ctr@mail.mil > > writes:<br><br> Amin> What we are trying to do is rotate the syslog.log file once it<br> Amin> reaches 500 MB (as well as looking into rotating file every 24<br> Amin> hours)? Once the log file rotates, it creates a new file named<br> Amin> syslog.log.0 and so on..<br><br>syslog-ng does not support size-based rotation, you'll have to configure logrotate for that. See the packaging/debian/syslog-ng-core.syslog-ng.logrotate[1] file for an example.<br><br> [1]: Caution-Caution-https://github.com/balabit/syslog-ng/blob/master/packaging/debian/syslog-ng-core.syslog-ng.logrotate < Caution-https://github.com/balabit/syslog-ng/blob/master/packaging/debian/syslog-ng-core.syslog-ng.logrotate > <br><br>With logrotate, the most recent logfile syslog-ng writes to will always be syslog.log, and the rotated files will have different names - depending on the logrotate configuration you use.<br><br>For time-based, daily rotation, you can use templates in the destination filename, such as:<br><br>destination d_syslog {<br> file("/var/log/syslog-${YEAR}-${MONTH}-${DAY}.log");<br>};<br><br>Hope this helps!<br><br>-- <br>|8]<br><br><br>______________________________________________________________________________<br>Member info: Caution-https://lists.balabit.hu/mailman/listinfo/syslog-ng < Caution-https://lists.balabit.hu/mailman/listinfo/syslog-ng > <br>Documentation: Caution-http://www.balabit.com/support/documentation/?product=syslog-ng < Caution-http://www.balabit.com/support/documentation/?product=syslog-ng > <br>FAQ: Caution-http://www.balabit.com/wiki/syslog-ng-faq < Caution-http://www.balabit.com/wiki/syslog-ng-faq > <br><br><o:p></o:p></p></blockquote></div></div></div></body></html>