[syslog-ng] Closing destination file when date changes.

[Gergely Nagy]

Sandor Geller <Sandor.Geller at morganstanley.com> writes:

> On Fri, Mar 22, 2013 at 9:37 AM, andrea.meconi at libero.it
> <andrea.meconi at libero.it> wrote:
>> Hello.
>> I'm using a very simple configuration on Ubuntu 12.04.2 LTS
>>
>>
>> @version: 3.3
>> @include "scl.conf"
>> source from-network { udp(ip("0.0.0.0") port(514)); };
>> destination local-file {
>> file("/var/log/temporary-encrypted/$YEAR-$MONTH-$DAY.log"); };
>> log { source(from-network); destination(local-file);};
>>
>>
>> Log on a destination file using date as filename.
>> I need to close this file when date changes at 00:00. How?
>
> Unused file destinations could get reaped, see time_reap(). However
> you should take into account that the macros you used in the filename
> are dependent of keep_timestamp() and by default use the timestamp in
> the log message so the destination file could get opened when further
> logs arrive with timestamps referring to the given date... If you want
> to use files based on the receiver's time then I suggest using the R_
> macros.

That, and you can force syslog-ng to reinitialize the destinations by
sending it a HUP signal. So using the R_* family of macros, and sending
a SIGHUP shortly after 00:00 will result in syslog-ng closing the old
files.

-- 
|8]