[syslog-ng] Logrotate Questions And Solicitation For Ideas...

[Kevin]

> I wish to rotate them and keep at least N days worth.

I believe the OP is thinking the term "rotate" differently than others here.
If the desired effect is to always have today's events and 29 days into
the past,it's much easier to to have syslog-ng create and write to logfiles
named by the day-of-month, no manual "rotation" necessary.

On 7/20/06, JP Senior <JPSenior at veer.com> wrote:
> Vadim, in syslog_ng.conf:
>
> destination autorotatedlogs {
>        file(
>                "/var/logs/$HOST/$HOST.$DAY.log"
>                remove_if_older(2591000)
>        );
> };
>
> This should create 'server01-.04.log', and delete that file if it's
> older than 30 days (minus 1000 seconds for possible skewing), and start
> fresh anew the next time the 4th day of the month rolls by.

This is what I do, it works very well, I actually log by hour of the
day, so I use:
                "/var/logs/$HOST/$DAY/$HOUR.log"

> This should set you up with a 30 day log rotation.

Sometimes you will end up with a few old logfiles left sitting around,
for example, in months with fewer than 31 days.  If this is a real problem
you can add a cron script to explicitly purge logs older than 30 days,
as mentioned earlier in this thread.

Kevin