rsyslog writes to disk & log rotation
Hello,
I am using rsyslog to received syslog messages from my firewalls. I have setup logrotation to happen as per rsyslog's example: Code:
/etc/rsyslog.conf: How can I do log rotation but not drop any syslog events? I did a test by removing -mtime +1 and it dropped about 7 seconds of logs. I looked at rsyslog's disk queuing but that only applies if the destination is unavaliable but that will never be when it writes to disk. Thanks. |
Try -mmin http://linux.die.net/man/1/find
|
Thanks Chris. Will try that.
|
Quote:
Ergo Rsyslogd will close the old file and open a new one on day start. So the Rsyslogd part is not what you're having problems with. Quote:
Depending on how many hosts you need to handle, how long log files need to be stored and where they should be stored after processing I would rewrite the template as it IMHO makes no sense duplicating %HOSTNAME and having that much tree depth. With your current directory structure I would rewrite the cronjob this way: Code:
#!/bin/sh -- |
Thanks alot for the input. I will look into this further with some more testing.
Cheers. |
All times are GMT -5. The time now is 06:03 PM. |