How to automatically delete database contents?
Rsyslog supports writing to the database. Like with log files, the rsyslogd writes the data, but does not delete (or export) it. If you need the data only for a period of time, simply deleting excess data might be a workable solution.
Below are some examples how this can be done (thanks to Michael Meckelein for posting this in the forum):
You can start a script via cron job, e. g.
mysql -u database-userid -pdatabase-password -e “truncate table SystemEvents” database-name
to delete all data or like
mysql -u database-userid -pdatabase-password -e “DELETE FROM SystemEvents WHERE ReceivedAt < date_add(current_date, interval -1 day)” database-name
to delete data older than one day.
How to separate log files by host name of sending device?
Question:
I have activated remote logging and receiving syslog messages from several devices. I want to write a separate log file for each device sending syslog messages. How to achieve that?
Answer:
It is pretty easy. You can use dynaFiles for it. With them, you specify a template as the file name. For each message, the filename is re-generated and the output written to the respective file. Read the config file doc for details, but it basically is:
$template DynaFile,”/var/log/system-%HOSTNAME%.log”
*.* -?DynaFile