[syslog-ng] rotating log files on every 5 minutes

[Gergely Nagy]

Omer Faruk SEN <omerfsen at gmail.com> writes:

> Is it possible to rotate logs for every 5 minutes
>
> For example instead of using
>
> ${HOST}_${R_YEAR}${R_MONTH}${R_DAY}${R_HOUR}${R_MIN}.log I want to use
> ${HOST}_${R_YEAR}${R_MONTH}${R_DAY}${R_HOUR}${R_MIN%5}.log (which rotates
> every 5 minues )

Depends on what version of syslog-ng you're using. With 3.3 and earlier,
you can't, not without patching or very ugly hacks. With 3.4, you can do
something like this:

${HOST}_${R_YEAR}${R_MONTH}${R_DAY}${R_HOUR}$(/ ${R_MIN} 5).log

$(/ X Y) will divide X with Y, and truncate, so it will rotate every 5
minutes. $(% X Y) exists too, but since that returns the remainder of a
division, it would write each minute into a different file (up to 5
different files).

If you need it, I can port this functionality over to 3.2, it's fairly
trivial. But the chances that it would be integrated into the official
sources is slim to none, so until 3.4, you'd have to patch syslog-ng.

An alternative - but horribly ugly - solution, that works with 3.2 is to
abuse the $(if) template function somewhat like this:

$(if ("${R_MIN}" < 5) "0" "$(if ("${R_MIN}" < 10) "1" "...")")

I'm not going to write the whole stuff here, as it's painful already,
but I hope you get the idea (take an $(if), and embed the next in the
former's false branch, and return the desired filename part in the true
branch).

You can read more about the syntax of $(if) in the syslog-ng 3.2
documentation:
http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-v3.2-guide-admin-en.html/reference-template-functions.html

Come to think of it, you could even do it with filters! But I rarely use
filters, so if you want to go down this path, I'm unable to provide a
working example. But it seems possible at least.

Also: I did not test the above example, so your mileage may vary.

-- 
|8]