1
response

I am trying to rotate a log file in the Output module. Here is my configuration below:

Easier on the eyes (pastebin)


########################################
# Global directives                    #
########################################
User nxlog
Group nxlog

LogFile /var/log/nxlog/nxlog.log
LogLevel INFO
#SuppressRepeatingLogs FALSE

define WINLOG /logserv/collections/windows-collector/windows-collector-log.log

########################################
# Modules                              #
########################################
<Extension fileop>
        Module          xm_fileop
</Extension>

<Extension _syslog>
        Module          xm_syslog
</Extension>



<Input windows-collector-log>
        module          im_tcp
        host            0.0.0.0
        port            524
        Exec            parse_syslog();
        Exec            log_info("Severity Windows Collector: " + $SyslogSeverity + ", Hostname: " + $Hostname);
</Input>

<Output windows-collector-log-out>
        Module          om_file
        CreateDir    true
        File            '%WINLOG%'

     <Schedule>
                Every           30 sec
                Exec            if (file_size('%WINLOG%') >= 100M) file_cycle('%WINLOG%',500);
     </Schedule>
</Output>

<Route 5>
    Path            windows-collector-log => windows-collector-log-out
</Route>

 

I am getting an error saying that the file does not exist when the rotation is executed.

2015-08-19 13:22:23 ERROR failed to determine file size of '/logserv/collections/windows-collector/windows-collector-log.log': No such file or directory

AskedAugust 19, 2015 - 7:36pm

Answer (1)

Looks like you forgot to reopen the file. Now the output is kept written to the rotated file and %WINFILE% does not exist indeed. This should work:

     <Schedule>
                Every           30 sec
                Exec            if (file_size('%WINLOG%') >= 100M)  \
                                   { \
                                         file_cycle('%WINLOG%',500); \
                                         windows-collector-log-out->reopen(); \
                                   }
     </Schedule>