newsyslog - automaticaly remove unused logfiles

pmaechler

pmaechler

Dear BSD Users

I’m looking for a way to get rid of “abandoned” logfiles.
We are using syslog-ng and are rotating the files with newsyslog

Each client has his own logfile where we get stuff from syslog-ng. The files are in /var/log/syslog-ng/cpe/<customer>.log

The newsyslog config line is:
/var/log/syslog-ng/cpe/*.log 644 10 * @T00 JG

Now if a customer is leaving, we still have his log file, which is rotated on a daily basis.

Is there a nice way to tell newsyslog to do-not-create-logfiles? If a new message appears, syslog-ng is creating the file…

Initially I was thinking about deleting all empty files at 23:55 each day. But this may has the drawback that the files <customer>.0 to <customer>.9 are left behind (I haven’t tested this)
Deleting all the <customer>.* files is also a “bad” idea, since its possible that a client is not sending any logs for some days and I’d like to keep the last events (if they’re within the last 10 days)

Any hints are appreciated


Best regards
Philippe
 
newsyslog(8) doesn't create new logfiles, it only rotates old ones. A new (empty) log file is created by the application (in your case syslog-ng).
 
Thynk you SirDice for the fast reply!

hmm strange, the first line in those "empty" files is:
Jan 23 00:00:00 CustomerSyslog newsyslog[74654]: logfile turned over
this indicates, that newsyslog has created the file

The newsyslog() man-pages mentions in the description that:
Code: 
... When it is executed it archives log files if necessary. If a log file is determined to require archiving, newsyslog rearranges the files so that "logfile" is empty,
I'm not a native english speaker, but this I understand, that newsyslog creates an empty "logfile" (I'm wondering who or what writes the logfile turned over line...
 
Argh, yes. You're correct. That's what I get when I try to do different things at the same time (moderating here while tackling issues at work).
 
You must log in or register to reply here.
Back
Top