1

I using syslog-ng config file destination configuration to create hourly log files. The config I'm using for this is as follows:

destination d_hourly {file("/var/log/tracker/pid$PID-track-$YEAR-$MONTH-$DAY-$HOUR.log");};

I now have a requirement to create files every 15 mins or 30 mins. I looked through the config file macros and there is no such macro (which is on expected lines). Is there a way to write a custom function in syslog-ng config which returns a value based on the current time and which can be suffixed in the destination direction for syslog-ng.

Or is there some other way to achieve this?

Improve this question

2 Answers 2

Reset to default
2

You can divide the minute value by a number inline, which will generate separated files. For example:

destination d_half_hourly {file("/var/log/tracker/pid$PID-track-$YEAR-$MONTH-$DAY-$HOUR-$(/ $MIN 30).log");};

Because of integer division, this will put all logs from PID 1000 and date 1/23/2015 05:00 to 05:29 into

/var/log/tracker/pid1000-track-2015-01-23-05-0.log

and from 05:30 to 05:59 into

/var/log/tracker/pid1000-track-2015-01-23-05-1.log

You can also increase the frequency by changing 30 to another divisor.

Improve this answer
1
  • Thanks, this works like a charm :) I'm using syslog-ng 3.5.3. Commented Jun 12, 2015 at 7:44
0

there is no such built-in function, but in newer syslog-ng versions you can make various numerical comparisons in filters: http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-3.6-guides/en/syslog-ng-ose-v3.6-guide-admin/html/filters-comparing.html

If you combine this with embedded log paths, I think you can create a configuration that does what you need. For example, something like this pseudocode (just to show the idea, it's not syntactically correct):

log { source_mysource log { filter(is-$MIN-less-than-15) destination(file("/var/log/tracker/pid$PID-track-$YEAR-$MONTH-$DAY-$HOUR-0-15.log")) } log { filter(is-$MIN-between-16-and-30) destination(file("/var/log/tracker/pid$PID-track-$YEAR-$MONTH-$DAY-$HOUR-16-30.log")) } ... }

HTH,

Regards,

Robert Fekete

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.