1

I have implemented syslog server on CentOS and using below Template to generate output file on daily basis -

$template TmplNationalIP_PL, "/var/log/NIPFW/MX480/CGNAT_PL_%$year%.%$month%.%$day%"
if ($msg contains 'OR_NAT' and $msg contains '55.91.165.') then ?TmplNationalIP_PL
& ~

Similar to above (daily), I am looking to split syslog files on HOURLY basis (instead of daily).

How I can split syslog messages files on HOURLY basis as I couldn't find any HOURLY variables to use?

Also, I am using logrotate + cron jobs but there is no option to rotate hourly basis in logrotate (minimum is daily).

Below is the snip from cat /etc/logrotate.d/syslog

/var/log/NIPFW/MX480
{
        rotate 50
        daily
        copytruncate
        missingok
        notifempty
        compress
        delaycompress
        dateext
        maxage 30
        sharedscripts
        postrotate
                reload rsyslog >/dev/null 2>&1 || true
        endscript
}

2 Answers 2

2

cron and logrotate

The script /etc/cron.daily/logrotate is located in the daily folder.

You have to move it to /etc/cron.hourly and change daily to hourly in your config file.

2
  • thanks @Freddy but moving logrotate from /etc/cron.daily/ to /etc/cron.hourly will also impact every log in the system. But I wanted to rotate specific syslog as hourly and rest to remain as usual way (daily), like - 1. Specific logs (var/log/NIPFW/MX480/.log*) on hourly basis 2. Remaining logs (/var/log/ etc.*) as usual way (daily)
    – SarjitS
    Mar 12, 2019 at 5:46
  • Below is the config file for the same from /etc/logrotate.d/syslog /var/log/NIPFW/MX480/*.log { rotate 50 hourly copytruncate missingok notifempty compress delaycompress maxage 30 sharedscripts postrotate reload rsyslog >/dev/null 2>&1 || true endscript }
    – SarjitS
    Mar 12, 2019 at 5:46
0

The hour-based system property for rsyslog is appropriately called '$hour'. This is documented under the rsyslog Properties page.

Therefore, you can modify your template as shown below to generate hourly log files:

$template TmplNationalIP_PL,"/var/log/NIPFW/MX480/CGNAT_PL_%$year%.%$month%.%$day%.%$hour%"

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .