Hey all,
Another variant is to write to date named files and then you can
compress them directly after midnight.
Can't rotate on anything else based on time and date though so YMMV.
Example configuration:
template(name="omfileTemplate"
type="string"
string="/srv/logs/%$year%/%fromhost%/%fromhost%-%$now%.log"
)
action(type="omfile"
dynaFile="omfileTemplate"
template="SU_FileFormat"
)
BR,
- Simon
On Fri, 2021-08-27 at 16:34:51 +0200, Jean-Baptiste Denis via rsyslog
wrote:
> Hello,
>
> I've got a general question about logrotate postrotate script and rsyslog HUP
> signal handling interaction.
>
> Lets say I have this logrotate section:
>
> /var/log/messages
> {
> rotate 4
> daily
> dateext
> missingok
> notifempty
> compress
> postrotate
> /usr/bin/systemctl kill -s HUP rsyslog.service >/dev/null 2>&1
> || true
> endscript
> }
>
> And logrotate fires up. Something like might happen:
>
> 1. /var/log/messages is rotated to /var/log/messages-20210827
> 2. rsyslog is still writing to /var/log/messages-20210827
> 3. postrotate script runs, the kill signal command returns immediately
> 4. logrotate start compressing /var/log/messages-20210827
>
> The "real" handling of SIGUP happens in rsyslogd mainloop and could happen
> anywhere after 3, which means also after 4.
>
> When the /var/log/messages activity is high (about 100 messages/sec), I often
> have logrotate compression step
> complaining about "file size changed while zipping".
>
> I can workaround this using the delaycompress option, but I'd like to
> understand if my understanding is correct and if
> there is a better/cleaner solution ?
>
> If I'm correct until this point, I can only see two options:
>
> - using delaycompress in logrotate block
> - having a command line tool that tells rsyslogd to close and reopen the log
> files AND that does not exit before
> its done and use this command in postrotate
>
> What are your thoughts ? Any suggestions ?
>
> Thank you.
>
> Jean-Baptiste
>
>
>
>
>
> _______________________________________________
> rsyslog mailing list
> https://lists.adiscon.net/mailman/listinfo/rsyslog
> http://www.rsyslog.com/professional-services/
> What's up with rsyslog? Follow https://twitter.com/rgerhards
> NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
> sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
> LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
