0

I have implemented syslog server on CentOS and using below Template to generate output file on daily basis -

$template TmplNationalIP_PL, "/var/log/NIPFW/MX480/CGNAT_PL_%$year%.%$month%.%$day%"
if ($msg contains 'OR_NAT' and $msg contains '55.91.165.') then ?TmplNationalIP_PL
& ~

Similar to above (daily), I am looking to split syslog files on HOURLY basis (instead of daily).

How I can split syslog messages files on HOURLY basis as I couldn't find any HOURLY variables to use?

Also, I am using logrotate + cron jobs but there is no option to rotate hourly basis in logrotate (minimum is daily).

Below is the snip from cat /etc/logrotate.d/syslog

/var/log/NIPFW/MX480
{
        rotate 50
        daily
        copytruncate
        missingok
        notifempty
        compress
        delaycompress
        dateext
        maxage 30
        sharedscripts
        postrotate
                reload rsyslog >/dev/null 2>&1 || true
        endscript
}
0

The hour-based system property for rsyslog is appropriately called '$hour'. This is documented under the rsyslog Properties page.

Therefore, you can modify your template as shown below to generate hourly log files:

$template TmplNationalIP_PL,"/var/log/NIPFW/MX480/CGNAT_PL_%$year%.%$month%.%$day%.%$hour%"
0

cron and logrotate

The script /etc/cron.daily/logrotate is located in the daily folder.

You have to move it to /etc/cron.hourly and change daily to hourly in your config file.

  • thanks @Freddy but moving logrotate from /etc/cron.daily/ to /etc/cron.hourly will also impact every log in the system. But I wanted to rotate specific syslog as hourly and rest to remain as usual way (daily), like - 1. Specific logs (var/log/NIPFW/MX480/.log*) on hourly basis 2. Remaining logs (/var/log/ etc.*) as usual way (daily) – SarjitS Mar 12 at 5:46
  • Below is the config file for the same from /etc/logrotate.d/syslog /var/log/NIPFW/MX480/*.log { rotate 50 hourly copytruncate missingok notifempty compress delaycompress maxage 30 sharedscripts postrotate reload rsyslog >/dev/null 2>&1 || true endscript } – SarjitS Mar 12 at 5:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.