[syslog-ng]Syslog-ng conf file options not working!!!!

[Balazs Scheidler]

On Thu, Apr 10, 2003 at 09:40:49AM -0400, TIM MOORE wrote:
> Here is what I am trying to do.  We have all of our network monitoring devices logging to a central linux syslog-ng server.  The files write to the log server as the day of the week (eg. 01, 02, 03).  I am trying to make sure that when the month rolls over and starts writing to file 01 that they old file is blown away.  I don't need logs older than one month.  I can't seem to get syslog-ng to handle this on its own.  I have tried two options from syslog-ng that are given in the extended sample syslog-ng conf files from the website.  Neither have worked the way they said they should.
> 
> First, I tried limiting the number of lines that can be written to a file. 
> I set the log_fifo_size to (12288).  The sample config says that this
> setting is for the number of lines that can be written to the log files. 
> However, I have some log files that are over 1,000,000 lines.  So, unless
> I misunderstood this option it isn't working.

log_fifo_size limits the buffer used for write buffering.

> 
> Second, I tried to set the option remove_if_older to (172800) or 2 days. 
> The expanded sample config says that this option checks a file to see
> whether or not it is older than the number of seconds specified.  If it is
> older then it removes the existing file and writes to a new file with the
> same name.  This option would work perfectly, if it worked!  When I put it
> in the config file, it barfs when trying to load syslog-ng and says it is
> an error.  Any ideas on how to do this (without writing a script to blank
> out each days file at midnight).

try this one:

destination d_file { file("/var/log/messages.$MONTH" remove_if_older(172800)); };

-- 
Bazsi