Thank. I'm reconfiguring syslog-ng using macro and sending HUP. Regards. Andrea
----Messaggio originale---- Da: algernon@balabit.hu Data: 22/03/2013 15.44 A: "Syslog-ng users' and developers' mailing list"<syslog-ng@lists.balabit. hu> Ogg: Re: [syslog-ng] Closing destination file when date changes.
Sandor Geller <Sandor.Geller@morganstanley.com> writes:
On Fri, Mar 22, 2013 at 9:37 AM, andrea.meconi@libero.it <andrea.meconi@libero.it> wrote:
Hello. I'm using a very simple configuration on Ubuntu 12.04.2 LTS
@version: 3.3 @include "scl.conf" source from-network { udp(ip("0.0.0.0") port(514)); }; destination local-file { file("/var/log/temporary-encrypted/$YEAR-$MONTH-$DAY.log"); }; log { source(from-network); destination(local-file);};
Log on a destination file using date as filename. I need to close this file when date changes at 00:00. How?
Unused file destinations could get reaped, see time_reap(). However you should take into account that the macros you used in the filename are dependent of keep_timestamp() and by default use the timestamp in the log message so the destination file could get opened when further logs arrive with timestamps referring to the given date... If you want to use files based on the receiver's time then I suggest using the R_ macros.
That, and you can force syslog-ng to reinitialize the destinations by sending it a HUP signal. So using the R_* family of macros, and sending a SIGHUP shortly after 00:00 will result in syslog-ng closing the old files.
-- |8]
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog- ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq