Closing destination file when date changes.
Hello. I'm using a very simple configuration on Ubuntu 12.04.2 LTS @version: 3.3 @include "scl.conf" source from-network { udp(ip("0.0.0.0") port(514)); }; destination local-file { file("/var/log/temporary-encrypted/$YEAR-$MONTH-$DAY.log"); }; log { source(from-network); destination(local-file);}; Log on a destination file using date as filename. I need to close this file when date changes at 00:00. How? Thanks. Andrea
Hi, Unused file destinations could get reaped, see time_reap(). However you should take into account that the macros you used in the filename are dependent of keep_timestamp() and by default use the timestamp in the log message so the destination file could get opened when further logs arrive with timestamps referring to the given date... If you want to use files based on the receiver's time then I suggest using the R_ macros. hth, Sandor On Fri, Mar 22, 2013 at 9:37 AM, andrea.meconi@libero.it <andrea.meconi@libero.it> wrote:
Hello. I'm using a very simple configuration on Ubuntu 12.04.2 LTS
@version: 3.3 @include "scl.conf" source from-network { udp(ip("0.0.0.0") port(514)); }; destination local-file { file("/var/log/temporary-encrypted/$YEAR-$MONTH-$DAY.log"); }; log { source(from-network); destination(local-file);};
Log on a destination file using date as filename. I need to close this file when date changes at 00:00. How? Thanks. Andrea
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
Sandor Geller <Sandor.Geller@morganstanley.com> writes:
On Fri, Mar 22, 2013 at 9:37 AM, andrea.meconi@libero.it <andrea.meconi@libero.it> wrote:
Hello. I'm using a very simple configuration on Ubuntu 12.04.2 LTS
@version: 3.3 @include "scl.conf" source from-network { udp(ip("0.0.0.0") port(514)); }; destination local-file { file("/var/log/temporary-encrypted/$YEAR-$MONTH-$DAY.log"); }; log { source(from-network); destination(local-file);};
Log on a destination file using date as filename. I need to close this file when date changes at 00:00. How?
Unused file destinations could get reaped, see time_reap(). However you should take into account that the macros you used in the filename are dependent of keep_timestamp() and by default use the timestamp in the log message so the destination file could get opened when further logs arrive with timestamps referring to the given date... If you want to use files based on the receiver's time then I suggest using the R_ macros.
That, and you can force syslog-ng to reinitialize the destinations by sending it a HUP signal. So using the R_* family of macros, and sending a SIGHUP shortly after 00:00 will result in syslog-ng closing the old files. -- |8]
hi, right now, you can do that only via sending a sighup to syslog-ng at that time. syslog-ng will close that file after time-reap() seconds once no messages are received there. time-reap() defaults to 60 seconds iirc. hope this helps. ----- Original message -----
Hello. I'm using a very simple configuration on Ubuntu 12.04.2 LTS @version: 3.3 @include "scl.conf" source from-network { udp(ip("0.0.0.0") port(514)); }; destination local-file { file("/var/log/temporary-encrypted/$YEAR-$MONTH-$DAY.log"); }; log { source(from-network); destination(local-file);};
Log on a destination file using date as filename. I need to close this file when date changes at 00:00. How? Thanks. Andrea
participants (4)
-
andrea.meconi＠libero.it
-
Balazs Scheidler
-
Gergely Nagy
-
Sandor Geller