7
responses

What is the best way to do a log rotation?

I'm using fileop and I wanted log rotation at midnight, but it hasn't been working. Would it be better to move the Schedule to the Output section?

<Extension fileop>
    Module      xm_fileop

    # Check the size of our log file every hour and rotate if it is larger than 1Mb
    <Schedule>
        Every   1 hour
        Exec    if (file_size('%LOGFILE%') >= 1M) file_cycle('%LOGFILE%', 500);
    </Schedule>

    # Rotate our log file every week on sunday at midnight
    <Schedule>
        When    @midnight
        Exec    file_cycle('%LOGFILE%', 500);
    </Schedule>
</Extension>

AskedOctober 17, 2016 - 5:10pm

Answer (1)

The above is for rotating nxlog.log.

This should also work for files created with om_file but in that case you will need to also call reopen() from inside the Output block.

 

Comments (6)

  • b0ti's picture
    (NXLog)

    It's hard to tell without a config file. Do you see anything in nxlog.log?

    You could try debugging it by adding log_info() to print into nxlog.log:

    <Schedule>
            When    @midnight
            Exec    log_info("attempting to rotate %LOGFILE%"); file_cycle('%LOGFILE%', 500);
    </Schedule>

  • amani's picture

    This is how I setup the section.

    <Extension _fileop>

        Module      xm_fileop

        # Check the size of our log file every hour and rotate if it is larger than 1Mb
        <Schedule>
            Every   1 hour
            Exec    if (file_size('%LOGFILE%') >= 1M) file_cycle('%LOGFILE%', 500);
        </Schedule>

        # Rotate our log file every week on sunday at midnight
        <Schedule>
            When    @midnight
            Exec    file_cycle('%LOGFILE%', 500);
        </Schedule>
    </Extension>

  • amani's picture

    Panic Soft
    #NoFreeOnExit TRUE

    define ROOT D:\Program Files (x86)\nxlog
    #define ROOT C:\Program Files\nxlog
    define CERTDIR %ROOT%\cert
    define CONFDIR %ROOT%\conf
    define LOGDIR %ROOT%\data
    define LOGFILE '%LOGDIR%/nxlog.log'

    Moduledir %ROOT%\modules
    CacheDir %ROOT%\data
    Pidfile %ROOT%\data\nxlog.pid
    SpoolDir %ROOT%\data

    <Extension _syslog>
        Module      xm_syslog
    </Extension>

    <Extension _charconv>
        Module      xm_charconv
        AutodetectCharsets iso8859-2, utf-8, utf-16, utf-32
    </Extension>

    <Extension _exec>
        Module      xm_exec
    </Extension>

    <Extension _fileop>
        Module      xm_fileop

        # Check the size of our log file every hour and rotate if it is larger than 1Mb
        <Schedule>
            Every   1 hour
            Exec    log_info("attempting to rotate %LOGFILE%"); file_cycle('%LOGFILE%', 500);
            Exec    if (file_size('%LOGFILE%') >= 1M) file_cycle('%LOGFILE%', 500);
        </Schedule>

        # Rotate our log file every week on sunday at midnight
        <Schedule>
            When    @midnight
            Exec    log_info("attempting to rotate %LOGFILE%"); file_cycle('%LOGFILE%', 500);
            Exec    file_cycle('%LOGFILE%', 500);
        </Schedule>
    </Extension>

    <Input tcpin>
        Module im_tcp
        Host 0.0.0.0
        Port 1514
        Exec parse_syslog_bsd();
    </Input>

    <Output tcpout>
        Module    om_file
        File %LOGFILE%
    </Output>

    <Route tcp>
        Priority 1
        Path tcpin => tcpout
    </Route>

  • b0ti's picture
    (NXLog)

    define LOGFILE '%LOGDIR%/nxlog.log'

    With the above both nxlog (internal logging) and om_file are writing the same file which is not a good thing to do.

    The following should do what you need:

    define TCPLOG '%LOGDIR%/tcplog.log'
    <Output tcpout>
        Module    om_file
        File %TCPLOG%
    
        <Schedule>
            When    @midnight
            <Exec>
              log_info("attempting to rotate %TCPLOG%");
              file_cycle(%TCPLOG%, 500);
              tcpout->reopen();
            </Exec>
        </Schedule>
    </Output>