There's an important point to note, if you want to use logrotate on a hourly basis.
man logrotate.conf: hourly Log files are rotated every hour. Note that usually logrotate is configured to be run by cron daily. You have to change this configuration and run logrotate hourly to be able to really rotate logs hourly. So you'll have to move /etc/cron.daily/logrotate in /etc/cron.hourly/logrotate On Tue, Mar 12, 2019 at 9:32 AM Peter Viskup via rsyslog < [email protected]> wrote: > Copying logrotate to /etc/cron.daily is correct. Then logrotate will check > the configuration files and rotate only those logs which should be rotated > according the configuration. > Value of maxage is in days and you should probably change the value to 3 to > correspond with rotate value. Read the manpage for more information [1]. > > [1] https://manpages.debian.org/stretch/logrotate/logrotate.8.en.html > > On Tue, Mar 12, 2019 at 7:01 AM sarjit yadav via rsyslog < > [email protected]> wrote: > > > Thanks @Flo, it worked like charm. > > > > Also I would like to do housekeeping(*compression/rotation/deletion*) of > > specific syslog files with the help of *cron *& *logrotate *(*on hourly > > basis*). > > > > > > I thought of copying *logrotate *from* /etc/cron.daily/ *to > > */etc/cron.hourl*y but this will also impact every log in the system. > > > > And I want to rotate specific syslog files as hourly and rest to remain > as > > usual way (daily), like - > > > > 1. Specific logs (var/log/NIPFW/MX480/*.log) on hourly basis > > 2. Remaining logs (/var/log/* etc.) as usual way (daily) > > > > Below is the config file for the same /etc/logrotate.d/syslog > > /var/log/NIPFW/MX480/*.log > > { > > rotate 50 > > hourly > > copytruncate > > missingok > > notifempty > > compress > > delaycompress > > maxage 30 > > sharedscripts > > postrotate > > reload rsyslog >/dev/null 2>&1 || true > > endscript > > } > > > > Any guidance will be much helpful. > > Thank You. > > > > > > On Tue, Mar 5, 2019 at 7:30 PM Flo Rance <[email protected]> wrote: > > > > > Did you try to simply add %$hour% ? > > > > > > E.g. "/var/log/NIPFW/MX480/CGNAT_PL_%$year%.%$month%.%$day%.%$hour%" > > > > > > https://www.rsyslog.com/doc/v8-stable/configuration/properties.html > > > > > > Flo > > > > > > On Tue, Mar 5, 2019 at 2:04 PM sarjit yadav via rsyslog < > > > [email protected]> wrote: > > > > > >> Hello All, > > >> > > >> I have implemented syslog server on CentOS and using below *Template > *to > > >> generate output file names - > > >> > > >> > > >> *$template TmplNationalIP_PL, > > >> "/var/log/NIPFW/MX480/CGNAT_PL_%$year%.%$month%.%$day%"* > > >> *if ($msg contains 'OR_NAT' and $msg contains '55.91.165.') then > > >> ?TmplNationalIP_PL* > > >> *& ~* > > >> > > >> > > >> Similar to above (*daily*), I am looking to have syslog splitted > output > > >> file names *HOURLY *(instead of daily). > > >> > > >> Can you please suggest how I can split syslog messages on HOURLY basis > > as > > >> I couldn't find any variables to be used to have HOURLY in output file > > >> names ? > > >> > > >> Many thanks in advance. > > >> > > >> > > >> -- > > >> > > >> Regards > > >> > > >> Sarjit Singh > > >> > > >> *(**: +91-8806664923* > > >> _______________________________________________ > > >> rsyslog mailing list > > >> http://lists.adiscon.net/mailman/listinfo/rsyslog > > >> http://www.rsyslog.com/professional-services/ > > >> What's up with rsyslog? Follow https://twitter.com/rgerhards > > >> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a > myriad > > >> of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > >> DON'T LIKE THAT. > > >> > > > > > _______________________________________________ > > rsyslog mailing list > > http://lists.adiscon.net/mailman/listinfo/rsyslog > > http://www.rsyslog.com/professional-services/ > > What's up with rsyslog? Follow https://twitter.com/rgerhards > > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > > DON'T LIKE THAT. > > > _______________________________________________ > rsyslog mailing list > http://lists.adiscon.net/mailman/listinfo/rsyslog > http://www.rsyslog.com/professional-services/ > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
