On Thu, Apr 10, 2003 at 09:40:49AM -0400, TIM MOORE wrote:
Here is what I am trying to do. We have all of our network monitoring devices logging to a central linux syslog-ng server. The files write to the log server as the day of the week (eg. 01, 02, 03). I am trying to make sure that when the month rolls over and starts writing to file 01 that they old file is blown away. I don't need logs older than one month. I can't seem to get syslog-ng to handle this on its own. I have tried two options from syslog-ng that are given in the extended sample syslog-ng conf files from the website. Neither have worked the way they said they should.
First, I tried limiting the number of lines that can be written to a file. I set the log_fifo_size to (12288). The sample config says that this setting is for the number of lines that can be written to the log files. However, I have some log files that are over 1,000,000 lines. So, unless I misunderstood this option it isn't working.
log_fifo_size limits the buffer used for write buffering.
Second, I tried to set the option remove_if_older to (172800) or 2 days. The expanded sample config says that this option checks a file to see whether or not it is older than the number of seconds specified. If it is older then it removes the existing file and writes to a new file with the same name. This option would work perfectly, if it worked! When I put it in the config file, it barfs when trying to load syslog-ng and says it is an error. Any ideas on how to do this (without writing a script to blank out each days file at midnight).
try this one: destination d_file { file("/var/log/messages.$MONTH" remove_if_older(172800)); }; -- Bazsi