1
answer

I am trying to rotate a log file in the Output module. Here is my configuration below:

Easier on the eyes (pastebin)



########################################
# Global directives #
########################################
User nxlog
Group nxlog

LogFile /var/log/nxlog/nxlog.log
LogLevel INFO
#SuppressRepeatingLogs FALSE

define WINLOG /logserv/collections/windows-collector/windows-collector-log.log

########################################
# Modules #
########################################
<Extension fileop>
Module xm_fileop
</Extension>

<Extension _syslog>
Module xm_syslog
</Extension>



<Input windows-collector-log>
module im_tcp
host 0.0.0.0
port 524
Exec parse_syslog();
Exec log_info("Severity Windows Collector: " + $SyslogSeverity + ", Hostname: " + $Hostname);
</Input>

<Output windows-collector-log-out>
Module om_file
CreateDir true
File '%WINLOG%'

<Schedule>
Every 30 sec
Exec if (file_size('%WINLOG%') >= 100M) file_cycle('%WINLOG%',500);
</Schedule>
</Output>

<Route 5>
Path windows-collector-log => windows-collector-log-out
</Route>



 

I am getting an error saying that the file does not exist when the rotation is executed.

2015-08-19 13:22:23 ERROR failed to determine file size of '/logserv/collections/windows-collector/windows-collector-log.log': No such file or directory

AskedAugust 19, 2015 - 7:36pm

Answer (1)

Looks like you forgot to reopen the file. Now the output is kept written to the rotated file and %WINFILE% does not exist indeed. This should work:

     <Schedule>
                Every           30 sec
                Exec            if (file_size('%WINLOG%') >= 100M)  \
                                   { \
                                         file_cycle('%WINLOG%',500); \
                                         windows-collector-log-out->reopen(); \
                                   }
     </Schedule>

 

AnsweredAugust 19, 2015 - 7:48pm