[syslog-ng] remove_if_older()

[K K]

>>> It seems that the age check is only
>>> made the first time the file is written too. I've had a quick look
>>> through the code and it looks like the age check is only made in
>>> affile_dw_init, which I assume is called when the file is first opened.
>>> This would be consistent with my observations.
>>>
>>> Is this the intended behaviour?

I believe it is called when first opened, and also when existing files
are re-opened?


> Ok, that makes a lot of sense.
> Although it does make me wonder what the
> intended use of this option actually is.

I believe the intended use is this:

options {
        time_reap(3600);
        . . .
}
. . .
destination d_routers {
        file("/var/log/routers/$WEEKDAY/$HOUR" remove_if_older(259200) );
}

In this case, logs are automatically "rotated", by virtue of being
written to directories named for the day of week, and files named for
the hour of the day.  So right now syslog-ng is writing
/var/log/routers/Tue/16.
When next Tuesday comes around, the old "16" file should be removed
and recreated, instead of appending to week-old data.

Kevin