0

For example, on a syslog collector, where remote syslog is coming into /var/syslog/<host>/*.log, can I have something like the following in my logrotate config:

/var/syslog/*/*.log {
    daily
    keep 7
    compress
    delaycompress
    sharedscripts
    postrotate
        /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
    endscript
}
2

Thanks to both a colleague and Patrick Mevzek for finding the answer to this question.

Quoting from rfaircloth.com:

Create log rotation configuration /etc/logrotate.d/splunk-syslog:

/var/splunk-syslog/*/*.log { 
    daily
    compress
    delaycompress
    rotate 4 
    ifempty
    maxage 7
    nocreate
    missingok
    sharedscripts
    postrotate
        /bin/kill -HUP `cat /var/run/syslogd-ng.pid 2> /dev/null` 2> /dev/null || true 
    endscript
 }

This is OOTB functionality as of at least RHEL/CentOS 7 and Ubuntu 16 LTS.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.