Hello,

I am a rookie when it comes to Linux, and I have been tasked with creating a syslog server using Ubuntu to hold logs for 100+ networking devices. I wanted a separate log for each source ip address and dynamically created with the date. I achieved this with the following in /etc/rsyslog.conf

$IncludeConfig /etc/rsyslog.d/*.conf

$template TraditionalFormat,"%timegenerated% %HOSTNAME% %syslogtag%%msg:::drop-last-lf%\n"

$template DailyPerHostLogs,"/var/log/remotehosts/%HOSTNAME%.%$YEAR%-%$MONTH%-%$DAY%.log"
*.* -?DailyPerHostLogs;TraditionalFormat
& ~



Below is the relevant section of /etc/logrotate.d/rsyslog. (IP addresses replaced with XXX or YYY). I tried 2 different settings for 2 different logs and neither works.


##TEST1##
/var/log/remotehosts/XXX.XXX.XXX.XXX.*.log {
rotate 1
maxage 2
daily
missingok
notifempty
postrotate
/etc/init.d/rsyslog restart >/dev/null 2>&1 || true
endscript
}

##TEST2##
/var/log/remotehosts/YYY.YYY.YYY.YYY.*.log {
rotate 30
daily
missingok
notifempty
maxage 2
postrotate
reload rsyslog >/dev/null 2>&1 || true
endscript
}

Here is what is currently in my log location

-rw-r--r-- 1 root root 0 Dec 12 06:26 XXX.XXX.XXX.XXX.2012-12-11.log
-rw-r--r-- 1 root root 3236940 Dec 11 23:59 XXX.XXX.XXX.XXX.2012-12-11.log.1
-rw-r--r-- 1 root root 0 Dec 13 06:35 XXX.XXX.XXX.XXX.2012-12-12.log
-rw-r--r-- 1 root root 7033328 Dec 12 23:59 XXX.XXX.XXX.XXX.2012-12-12.log.1
-rw-r--r-- 1 root root 2369832 Dec 12 06:26 XXX.XXX.XXX.XXX.2012-12-12.log.2
-rw-r--r-- 1 root root 0 Dec 14 06:31 XXX.XXX.XXX.XXX.2012-12-13.log
-rw-r--r-- 1 root root 6566549 Dec 13 23:59 XXX.XXX.XXX.XXX.2012-12-13.log.1
-rw-r--r-- 1 root root 0 Dec 15 06:51 XXX.XXX.XXX.XXX.2012-12-14.log
-rw-r--r-- 1 root root 8569767 Dec 14 23:59 XXX.XXX.XXX.XXX.2012-12-14.log.1
-rw-r--r-- 1 root root 0 Dec 16 06:46 XXX.XXX.XXX.XXX.2012-12-15.log
-rw-r--r-- 1 root root 9113066 Dec 15 23:59 XXX.XXX.XXX.XXX.2012-12-15.log.1
-rw-r--r-- 1 root root 0 Dec 17 06:28 XXX.XXX.XXX.XXX.2012-12-16.log
-rw-r--r-- 1 root root 13063562 Dec 16 23:59 XXX.XXX.XXX.XXX.2012-12-16.log.1
-rw-r--r-- 1 root root 0 Dec 18 06:47 XXX.XXX.XXX.XXX.2012-12-17.log
-rw-r--r-- 1 root root 7929472 Dec 17 23:59 XXX.XXX.XXX.XXX.2012-12-17.log.1
-rw-r--r-- 1 root root 4438687 Dec 18 13:58 XXX.XXX.XXX.XXX.2012-12-18.log
-rw-r--r-- 1 root root 0 Dec 14 06:31 YYY.YYY.YYY.YYY.2012-12-06.log
-rw-r--r-- 1 root root 6843 Dec 6 23:17 YYY.YYY.YYY.YYY.2012-12-06.log.1
-rw-r--r-- 1 root root 0 Dec 14 06:31 YYY.YYY.YYY.YYY.2012-12-07.log
-rw-r--r-- 1 root root 23574 Dec 7 23:17 YYY.YYY.YYY.YYY.2012-12-07.log.1
-rw-r--r-- 1 root root 0 Dec 14 06:31 YYY.YYY.YYY.YYY.2012-12-08.log
-rw-r--r-- 1 root root 7693 Dec 8 23:17 YYY.YYY.YYY.YYY.2012-12-08.log.1
-rw-r--r-- 1 root root 0 Dec 14 06:31 YYY.YYY.YYY.YYY.2012-12-09.log
-rw-r--r-- 1 root root 8020 Dec 9 23:17 YYY.YYY.YYY.YYY.2012-12-09.log.1
-rw-r--r-- 1 root root 0 Dec 14 06:31 YYY.YYY.YYY.YYY.2012-12-10.log
-rw-r--r-- 1 root root 10790 Dec 10 23:17 YYY.YYY.YYY.YYY.2012-12-10.log.1
-rw-r--r-- 1 root root 0 Dec 14 06:31 YYY.YYY.YYY.YYY.2012-12-11.log
-rw-r--r-- 1 root root 19424 Dec 11 23:17 YYY.YYY.YYY.YYY.2012-12-11.log.1
-rw-r--r-- 1 root root 0 Dec 14 06:31 YYY.YYY.YYY.YYY.2012-12-12.log
-rw-r--r-- 1 root root 7842 Dec 12 23:17 YYY.YYY.YYY.YYY.2012-12-12.log.1
-rw-r--r-- 1 root root 0 Dec 14 06:31 YYY.YYY.YYY.YYY.2012-12-13.log
-rw-r--r-- 1 root root 16021 Dec 13 23:17 YYY.YYY.YYY.YYY.2012-12-13.log.1
-rw-r--r-- 1 root root 0 Dec 15 06:51 YYY.YYY.YYY.YYY.2012-12-14.log
-rw-r--r-- 1 root root 13646 Dec 14 23:17 YYY.YYY.YYY.YYY.2012-12-14.log.1
-rw-r--r-- 1 root root 0 Dec 16 06:46 YYY.YYY.YYY.YYY.2012-12-15.log
-rw-r--r-- 1 root root 14604 Dec 15 23:17 YYY.YYY.YYY.YYY.2012-12-15.log.1
-rw-r--r-- 1 root root 0 Dec 17 06:28 YYY.YYY.YYY.YYY.2012-12-16.log
-rw-r--r-- 1 root root 16194 Dec 16 23:17 YYY.YYY.YYY.YYY.2012-12-16.log.1
-rw-r--r-- 1 root root 0 Dec 18 06:47 YYY.YYY.YYY.YYY.2012-12-17.log
-rw-r--r-- 1 root root 17130 Dec 17 23:17 YYY.YYY.YYY.YYY.2012-12-17.log.1
-rw-r--r-- 1 root root 18255 Dec 18 13:45 YYY.YYY.YYY.YYY.2012-12-18.log




So, initially I want to be able to delete all files that are older than X day(s). And modify this value based on the device. In this example, I want XXX to delete files older than 1 day and YYY to delete files older than 30. It seems like it is renaming the old file with a .1 at the end, creating a new file that is empty, and that is it. I've researched this for hours and tried various things found in the man pages but nothing seems to produce the result that I want. Any help would be appreciated. If I didn't explain something correctly, please let me know.

Thanks!!

Is your syslog server logs rotating correctly? If so then check to see how the default syslogd and rsyslogd are being treated.

For example on my CentOS server I have:

Rather then a direct init.d restart of the deamon.

Here's also my syslog.d entry that's doing a daily rotate of logs from a remote device:

You could do something like this, modify the 90 to meet your needs (this deletes log files last modified more than 90 days ago).

You can also try adding "copytruncate" into your definition.

Im sorry it has taken so long to reply - I have been out for Christmas. I attempted your suggestions but was still unsuccessful. I came to the idea that maybe the dynamic portion of the code was the issue %HOSTNAME%.%$YEAR%-%$MONTH%-%$DAY%.log and instead reverted to an individual log as so:

$template TraditionalFormat,"%timegenerated% %HOSTNAME% %syslogtag%%msg:::drop-last-lf%\n"

if $fromhost-ip == 'XXX.XXX.XXX.XXX' then /var/log/remotehosts/FW.log
*.* -?TraditionalFormat
& ~


I modified the logrotate.d/rsyslog.conf like this:

##FW##
/var/log/remotehosts/FW.log
{
rotate 2
daily
missingok
notifempty
ipostrotate
reload rsyslog >/dev/null 2>&1 || true
endscript
}


Now it doesn't appear to be rotating at all... It created one empty file FW.log.1 and just kept appending the original file for many days. Also, I'm not sure if this would cause anything, but when I deleted the original directory, modified this code, and first restarted the rsyslog service, the /var/log/remotehosts directory denied me access. So I did chmod 777 /var/log/remotehosts..... Any ideas? I appreciate the help that you have already offered.

Turned out to be a permissions issue..The solution was:

create 640 syslog adm

Also did

sudo chown syslog:adm remotehosts
sudo chown syslog:adm FW.log