How to rotate log file in syslog-ng file based on file size
Dear Team, I am receiving a log of around 80GB per day. I want to make a log file of fixed size (suppose 10Gb) and after that file size crossed, new file should be created. How to do that? My present configuration is : ------------------------------------ @version:3.2 options { # sync(0); # stats (0); flush_lines(0); stats_freq(0); ts_format(iso); keep_hostname(yes); log_fifo_size(1024); }; source s_sys { file ("/proc/kmsg" program_override("kernel: ")); unix-stream ("/dev/log"); internal(); udp(ip(0.0.0.0) port(514)); }; destination d_cons { file("/dev/console"); }; #destination d_mesg { file("/home1/log/syslog-ng.log"); }; destination d_mesg { file("/home1/asa-log/syslog-ng/$HOST/$YEAR/$MONTH/$DAY/$FACILITY-$HOST-$YEAR-$MONTH-$DAY" owner(root) group(root) perm(0600) dir_perm(0700) create_dirs(yes) ); }; destination d_auth { file("/var/log/secure"); }; destination d_mail { file("/var/log/maillog" flush_lines(10)); }; destination d_spol { file("/var/log/spooler"); }; destination d_boot { file("/var/log/boot.log"); }; destination d_cron { file("/var/log/cron"); }; destination d_kern { file("/var/log/kern"); }; destination d_mlal { usertty("*"); }; filter f_kernel { facility(kern); }; filter f_default { level(info..emerg) and not (facility(mail) or facility(authpriv) or facility(cron)); }; filter f_auth { facility(authpriv); }; filter f_mail { facility(mail); }; filter f_emergency { level(emerg); }; filter f_news { facility(uucp) or (facility(news) and level(crit..emerg)); }; filter f_boot { facility(local7); }; filter f_cron { facility(cron); }; #log { source(s_sys); filter(f_kernel); destination(d_cons); }; log { source(s_sys); filter(f_kernel); destination(d_kern); }; log { source(s_sys); filter(f_default); destination(d_mesg); }; log { source(s_sys); filter(f_auth); destination(d_auth); }; log { source(s_sys); filter(f_mail); destination(d_mail); }; log { source(s_sys); filter(f_emergency); destination(d_mlal); }; log { source(s_sys); filter(f_news); destination(d_spol); }; log { source(s_sys); filter(f_boot); destination(d_boot); }; log { source(s_sys); filter(f_cron); destination(d_cron); }; -- ---- With Regards Balbir Singh Hora Scientist - 'C', Operation and Routing Group M/O of Communication and IT, NIC A-BLOCK, CGO Complex, New Delhi.
Balbir Singh <sbalbir@nic.in> writes:
Dear Team,
I am receiving a log of around 80GB per day. I want to make a log file of fixed size (suppose 10Gb) and after that file size crossed, new file should be created.
How to do that?
At the moment, this is not possible with syslog-ng alone. You can use logrotate, the 'size' option of it in particular, to achieve what you want. Something like: /var/log/big-logs/* { size 10G postrotate /etc/init.d/syslog-ng reload endscript rotate 100 missingok } It might be worth changing the destination in your config to use a flatter structure, so logrotate can do it's job. -- |8]
participants (2)
-
Balbir Singh
-
Gergely Nagy