LinuxQuestions.org - How to limit log file size with syslog-ng?

- Linux - Software (https://www.linuxquestions.org/questions/linux-software-2/)

- - How to limit log file size with syslog-ng? (https://www.linuxquestions.org/questions/linux-software-2/how-to-limit-log-file-size-with-syslog-ng-779801/)

How to limit log file size with syslog-ng?

Hi all experts,
I have a self-made application running on a small embedded Linux device (which should not matter) using syslog to output some error, warning or debug logs.
There is a "better" syslog daemon installed, called syslog-ng, which have some more features, but I miss a very important one:
How to limit the size of the logfiles to some dedicated megabytes. I was able to create rotating logfiles with the configuration in syslog-ng.conf:

Code:

destination testlog { 

  file("/var/log/test/log-$S_WEEKDAY" 

#  overwrite_if_older(100000) 

  owner("root") 

  group("adm") 

  perm(0640) 

  create_dirs(yes)

  template( "$MONTH-$DAY $HOUR:$MIN:$SEC $LEVEL $PROGRAM>$MSGONLY\n") );

};

But this only splits the week into 7 files, where each one grow endless. The "overwrite_if_older(100000)" is not working on my installation, so each day is appended to that output of the previous week.

Is there a possibility to limit the size of each file to e.g. 10Mb and cut the oldest part of the file?

Here is my environment:

Debian with kernel 2.6.21
syslog-ng 1.6.5
A small ARM processor running at 500MHz

Thanks
Achim

I don't know how much help this will be, as you mention that you are embedded, but I personally use "logrotate" to manage rotation of my "syslog-ng" logs. "logrotate" does allow you to limit sizes of files, but will only run periodically, or when called... so your file could grow larger in the few moments between a cron-poll for example. This is a very typical usage scenario though, as often logs are written to fixed partitions, etc. Unfortunately as far as the standard "syslog-ng" goes, there is no log-size option/limiter (reference: man 5 syslog-ng.conf)

My approach was not to use logrotate, because of this article. But it looks like in my case is no way around it.

Thanks for the answer
Achim