Syslog in small files
Hi
I'm running NXlog community for years with this configuration:
########################################
<Extension exec>
Module xm_exec
</Extension>
<Extension syslog>
Module xm_syslog
</Extension>
<Input syslog514udp>
Module im_udp
Port 514
Host 0.0.0.0
</Input>
<Input syslog514tcp>
Module im_tcp
Port 514
Host 0.0.0.0
</Input>
<Output consolefile>
Module om_file
File $MessageSourceAddress+"/Syslog-"+ strftime(now(),"%Y-%m-%d-%H") + ".log"
# Addiere Zeitstempel an den Event
Exec $raw_event = now() + " " + $raw_event;
CreateDir TRUE
</Output>
<Output cdrfile>
Module om_file
File $MessageSourceAddress+"/CDR/CDR-"+ strftime(now(),"%Y-%m-%d-%H") + ".log"
Exec if $raw_event =~ /<142>|<141>[S=\d+]\s|(.) / {
$raw_event = $1 ;
}
else
drop();
CreateDir TRUE
</Output>
<Output cdrlogger>
Module om_udp
Host 127.0.0.1
Port 1514
Exec if $raw_event =~ /<142>|<141>[S=\d+]\s|(.) / {
$raw_event = $1 ;
}
else
drop();
</Output>
<Route udp>
Priority 1
Path syslog514udp => consolefile, cdrfile, cdrlogger
</Route>
<Route tcp>
Priority 2
Path syslog514tcp => consolefile, cdrfile, cdrlogger
</Route>
###############################################
With this configuration I receive one log file per hour. Now I have a system which generates a 400MB file which is to large my syslog viewer. Is there a way to get multiple files per hours? Let's say four 100MB file per hour.
I've tried with to extend my configuration with:
<Exec>
if file->file_size() > 100M
{
$newfile = "tmp/output_" + $Hostname + "_" +
strftime(now(), "%Y%m%d%H%M%S");
file->rotate_to($newfile);
exec_async("/bin/bzip2", $newfile);
}
</Exec>
But I get the following error:
couldn't parse statement at line 24, character 28 in C:\Program Files (x86)\nxlog\conf\nxlog.conf; module file not found
Line 24 is the if statement. All required module are in the module folder.
has somebody a hint?