On Wed, 2004-12-01 at 21:55, Xiaodong Lin wrote:

Hi all,

I am wondering whether anyone here knows how to config syslog-ng to perform log file rollover. I was told that I can roll over a log file in syslog-ng by configuring syslog-ng in a format which includes time related macroes, such as $MONTH, $DAY, $HOUR, $MIN. For example

destination snort { file("/var/snort/snort-$MONTH$DAY$HOUR$MIN"); };

In this case, the log file should roll over to a new file every 1 minute. However, I found it doesn't work and syslog-ng keeps appending its received syslog message into a log file, for example snort-08091208.

Does anyone know how to do it or figure out what I have done wrong? Or does syslog-ng support the log file rollover?

it should work, however the macros referenced above use the timestamp found in the log message itself, thus if there is a timestamp with invalid stamp you might see messages appearing in wrong files. You might want to check out the S_ and R_ versions of the macros above. (one refers to the timestamp of the message, the other the time the message was received by syslog-ng) -- Bazsi