Use this documentation with care! It describes the outdated version 7, which was actively developed around 2014 and is considered dead by the rsyslog team.

This documentation reflects the latest update of the v7-stable branch. It describes the 7.6.8 version, which was never released. As such, it contains some content that does not apply to any released version.

To obtain the doc that properly matches your installed v7 version, obtain the doc set from your distro. Each version of rsyslog contained the version that exactly matches it.

As general advise, it is strongly suggested to upgrade to the current version supported by the rsyslog project. The current version can always be found on the right-hand side info box on the rsyslog web site.

Note that there is only limited rsyslog community support available for the outdated v7 version (officially we do not support it at all, but we usually are able to answer simple questions). If you need to stick with v7, it probably is best to ask your distribution for support.

back

Log rotation with rsyslog

Written by Michael Meckelein

Situation

Your environment does not allow you to store tons of logs? You have limited disc space available for logging, for example you want to log to a 124 MB RAM usb stick? Or you do not want to keep all the logs for months, logs from the last days is sufficient? Think about log rotation.

Log rotation based on a fixed log size

This small but hopefully useful article will show you the way to keep your logs at a given size. The following sample is based on rsyslog illustrating a simple but effective log rotation with a maximum size condition.

Use Output Channels for fixed-length syslog files

Lets assume you do not want to spend more than 100 MB hard disc space for you logs. With rsyslog you can configure Output Channels to achieve this. Putting the following directive

# start log rotation via outchannel
# outchannel definition
$outchannel log_rotation,/var/log/log_rotation.log, 52428800,/home/me/./log_rotation_script
#  activate the channel and log everything to it
*.* :omfile:$log_rotation
# end log rotation via outchannel

to ryslog.conf instruct rsyslog to log everything to the destination file ‘/var/log/log_rotation.log’ until the give file size of 50 MB is reached. If the max file size is reached it will perform an action. In our case it executes the script /home/me/log_rotation_script which contains a single command:

mv -f /var/log/log_rotation.log /var/log/log_rotation.log.1

This moves the original log to a kind of backup log file. After the action was successfully performed rsyslog creates a new /var/log/log_rotation.log file and fill it up with new logs. So the latest logs are always in log_rotation.log.

Conclusion

With this approach two files for logging are used, each with a maximum size of 50 MB. So we can say we have successfully configured a log rotation which satisfies our requirement. We keep the logs at a fixed-size level of 100 MB.

[manual index] [rsyslog.conf] [rsyslog site]

This documentation is part of the rsyslog project.

Copyright © 2008 by Rainer Gerhards and Adiscon. Released under the GNU GPL version 2 or higher.

Table Of Contents

Previous topic

Failover Syslog Server

Next topic

Development

This Page