AnonymousFox

//usr/share/doc/rsyslog-5.8.10/log_rotation_fix_size.html

<html><head>
<title>Keep the log file size accurate with log rotation</title>
<meta name="KEYWORDS" content="log rotation, howto, guide, fixed-size log">
</head>
<body>
<a href="rsyslog_conf_output.html">back</a>

<h1>Log rotation with rsyslog</h1>
		<P><small><i>Written by
		Michael Meckelein</i></small></P>
<h2>Situation</h2>

<p>Your environment does not allow you to store tons of logs? 
You have limited disc space available for logging, for example
you want to log to a 124 MB RAM usb stick? Or you do not want to
keep all the logs for months, logs from the last days is sufficient?
Think about log rotation.</p>

<h2>Log rotation based on a fixed log size</h2>

<p>This small but hopefully useful article will show you the way 
to keep your logs at a given size. The following sample is based on 
rsyslog illustrating a simple but effective log rotation with a 
maximum size condition.</p>

<h2>Use Output Channels for fixed-length syslog files</h2>

<p>Lets assume you do not want to spend more than 100 MB hard 
disc space for you logs. With rsyslog you can configure Output 
Channels to achieve this. Putting the following directive</p>

<p><pre>
# start log rotation via outchannel
# outchannel definiation
$outchannel log_rotation,/var/log/log_rotation.log, 52428800,/home/me/./log_rotation_script 
#  activate the channel and log everything to it 
*.* :omfile:$log_rotation
# end log rotation via outchannel
</pre></p>

<p>to ryslog.conf instruct rsyslog to log everything to the destination file 
'/var/log/log_rotation.log' until the give file size of 50 MB is reached. If 
the max file size is reached it will perform an action. In our case it executes 
the script /home/me/log_rotation_script which contains a single command:</p>

<p><pre>
mv -f /var/log/log_rotation.log /var/log/log_rotation.log.1
</p></pre>

<p>This moves the original log to a kind of backup log file. 
After the action was successfully performed rsyslog creates a new /var/log/log_rotation.log 
file and fill it up with new logs. So the latest logs are always in log_roatation.log.</p>

<h2>Conclusion</h2>

<p>With this approach two files for logging are used, each with a maximum size of 50 MB. So 
we can say we have successfully configured a log rotation which satisfies our requirement. 
We keep the logs at a fixed-size level of100 MB.</p>
<p>[<a href="manual.html">manual index</a>]
[<a href="rsyslog_conf.html">rsyslog.conf</a>]
[<a href="http://www.rsyslog.com/">rsyslog site</a>]</p>
<p><font size="2">This documentation is part of the
<a href="http://www.rsyslog.com/">rsyslog</a> project.<br>
Copyright &copy; 2008 by <a href="http://www.gerhards.net/rainer">Rainer Gerhards</a> and
<a href="http://www.adiscon.com/">Adiscon</a>. Released under the GNU GPL
version 2 or higher.</font></p>

</body>
</html>