Hi all,

I can...

 - rotate log files based on size.

 - rotate log files based on size using event fields- such as $Hostname from Syslog

 - rotate log files based on size and schedule.

I CANNOT rotate log files based on size and schedule using event fields !  It seems that the Schedule component does not like references to fields.

At end of tether, please help.


ERROR invalid om_file keyword: $newfilepath


<Extension syslog>
    Module xm_syslog
<Input in>
    Module im_udp
    Port 514
    Exec parse_syslog();
<Output out>
    Module om_file
$newfilepath = "D:/Test/" + $Hostname + "/" + $SourceName + "/"
$currfilename = strftime(now(), "%Y%m%d") + ".current"
File $newfilepath + $currfilename
# Check the size of our log file every minute and rotate if it is larger than 1Mb
Every 60 sec
Exec if (out->file_size() >= 1M) \
{ \
$newfilename = $newfilepath + strftime(now(), "%Y%m%dT%H%M%S") + ".s"); \
out->rotate_to($newfilename); \
CreateDir   TRUE
<Route 1>
    Path in => out


Thanks in advance. Paul


AskedJuly 31, 2017 - 11:04pm

Answer (1)

The <Schedule> block is not triggered/evaluated in the context of an event record, thus you cannot use fields there.  You should use module variables instead.

Comments (1)

  • Paul_Thomas's picture

    The module variables (set var get var ) seem to be persistent.  Whereas I need to rotate numerous log files that have been created in various paths based on event field names (hostname / process name).  This was simply to consolidate the config and reduce hardcoding. 

    I can't see how to do this with schedule - so reverting to rotate_to based on size only that works fine.