mirror of
https://github.com/rsyslog/rsyslog.git
synced 2025-12-19 20:50:42 +01:00
70 lines
2.7 KiB
HTML
70 lines
2.7 KiB
HTML
<html><head>
|
|
<title>Keep the log file size accurate with log rotation</title>
|
|
<meta name="KEYWORDS" content="log rotation, howto, guide, fixed-size log">
|
|
</head>
|
|
<body>
|
|
<a href="rsyslog_conf_output.html">back</a>
|
|
|
|
<h1>Log rotation with rsyslog</h1>
|
|
<P><small><i>Written by
|
|
Michael Meckelein</i></small></P>
|
|
<h2>Situation</h2>
|
|
|
|
<p>Your environment does not allow you to store tons of logs?
|
|
You have limited disc space available for logging, for example
|
|
you want to log to a 124 MB RAM usb stick? Or you do not want to
|
|
keep all the logs for months, logs from the last days is sufficient?
|
|
Think about log rotation.</p>
|
|
|
|
<h2>Log rotation based on a fixed log size</h2>
|
|
|
|
<p>This small but hopefully useful article will show you the way
|
|
to keep your logs at a given size. The following sample is based on
|
|
rsyslog illustrating a simple but effective log rotation with a
|
|
maximum size condition.</p>
|
|
|
|
<h2>Use Output Channels for fixed-length syslog files</h2>
|
|
|
|
<p>Lets assume you do not want to spend more than 100 MB hard
|
|
disc space for you logs. With rsyslog you can configure Output
|
|
Channels to achieve this. Putting the following directive</p>
|
|
|
|
<p><pre>
|
|
# start log rotation via outchannel
|
|
# outchannel definiation
|
|
$outchannel log_rotation,/var/log/log_rotation.log, 52428800,/home/me/./log_rotation_script
|
|
# activate the channel and log everything to it
|
|
*.* $log_rotation
|
|
# end log rotation via outchannel
|
|
</pre></p>
|
|
|
|
<p>to ryslog.conf instruct rsyslog to log everything to the destination file
|
|
'/var/log/log_rotation.log' until the give file size of 50 MB is reached. If
|
|
the max file size is reached it will perform an action. In our case it executes
|
|
the script /home/me/log_rotation_script which contains a single command:</p>
|
|
|
|
<p><pre>
|
|
mv -f /var/log/log_rotation.log /var/log/log_rotation.log.1
|
|
</p></pre>
|
|
|
|
<p>This moves the original log to a kind of backup log file.
|
|
After the action was successfully performed rsyslog creates a new /var/log/log_rotation.log
|
|
file and fill it up with new logs. So the latest logs are always in log_roatation.log.</p>
|
|
|
|
<h2>Conclusion</h2>
|
|
|
|
<p>With this approach two files for logging are used, each with a maximum size of 50 MB. So
|
|
we can say we have successfully configured a log rotation which satisfies our requirement.
|
|
We keep the logs at a fixed-size level of100 MB.</p>
|
|
<p>[<a href="manual.html">manual index</a>]
|
|
[<a href="rsyslog_conf.html">rsyslog.conf</a>]
|
|
[<a href="http://www.rsyslog.com/">rsyslog site</a>]</p>
|
|
<p><font size="2">This documentation is part of the
|
|
<a href="http://www.rsyslog.com/">rsyslog</a> project.<br>
|
|
Copyright © 2008 by <a href="http://www.gerhards.net/rainer">Rainer Gerhards</a> and
|
|
<a href="http://www.adiscon.com/">Adiscon</a>. Released under the GNU GPL
|
|
version 2 or higher.</font></p>
|
|
|
|
</body>
|
|
</html>
|