On Wednesday, December 21, 2016, David Lang <da...@lang.hm> wrote: > On Wed, 21 Dec 2016, mostolog--- via rsyslog wrote: > > To contextualize: >> >> A server is generating multiple log files and sending them using RELP to >> a Rsyslog relay. I would love to automatically delete older logs files if >> they are already sent/acknowledged. >> >> >> Is there a way to make Rsyslog delete a file after successfully sending >> it via RELP? (and not modified in the last...day?) >> >> Is there an easy way to know, outside from Rsyslog, if a file has already >> been processed/sent, in order to delete the local file? >> >> Maybe an script which gets "reading offset" from state file and compares >> with file size... >> > > Rsyslog can't really know when a file isn't going to be written to any > longer. It doesn't even know if another program has the file open to write > to now.
Ok > In your situation, I would use a script with logger to write the messages > to /dev/log for rsyslog to process. If not sure if I understood. Actually I'm using docker containers and logs are redirected to host syslog. How would you config (eg: apache) to do this? > By spec, the write to /dev/log will not complete until rsyslog has the > message in it's queue. So your script can feed the log to rsyslog and > remove it immediatly after it's completed. I'm not sure if I understood this. Could you elaborate? > I'd put in an enhancement request for an option to imfile to delete files > when it's finished reading them. It was created with the assumption that > it's reading the file as it's being written, but I can see useful cases > where the files are made available to rsyslog (mv into a watched directory) > after they are complete. I'll create the issue. Thanks! _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
