2
responses

Hello All

Happy New Year!!!

I am trying to delete IIS logs older than 7 days.

I tried using the following:

<Extension _fileop>
Module xm_fileop
<Schedule>
Every 1 day
Exec file_remove('E:\\IIS Logs\\W3SVC1\\*.log', (now() - 6048000 ));
</Schedule>
</Extension>

But the above did not work - the file(s) were not deleted and no entries in the nxlog logfile.

Note: the nxlog-ce documentation states the following regarding wildcard usage:

file_remove(string file);
Remove file. It is possible to specify a wildcard in the filename (but not in the path). The backslash (\) must be escaped if used as the directory separator with wildcards (for example, C:\\test\\*.log). This procedure will reopen the LogFile if it is removed. An error is logged if the operation fails.

For Debugging purposes, I tried using the following:

<Extension _fileop>
Module xm_fileop

<Schedule>
Every 1 day
Exec if (file_ctime("E:\\IIS Logs\\W3SVC1\\*.log") <= now()) log_info("File is older");
</Schedule>
</Extension>

The following entry is in the nxlog logfile:

2019-01-02 18:10:19 ERROR failed to read file creation time on 'E:\IIS Logs\W3SVC1\*.log': The filename, directory name, or volume label syntax is incorrect.

Note: Maybe file_cname cannot except wildcards in the filename because if I use the following:

<Schedule>
Every 10 sec
Exec if (file_ctime("E:\\IIS Logs\\W3SVC1\\u_ex181224.log") <= now()) log_info("File is older");
</Schedule>

Then I receive the following in the nxlog logfile:

2019-01-02 18:23:08 INFO File is older

If I try the following:

<Schedule>
Every 10 sec
Exec if (file_ctime("E:\\IIS Logs\\W3SVC1\\u_ex181224.log") <= now()) log_info("File is older");
Exec file_remove("E:\\IIS Logs\\W3SVC1\\u_ex181224.log", (now() - 6048000 ));
</Schedule>

The following appears in nxlog logfile:

2019-01-02 18:26:26 INFO File is older
2019-01-02 18:26:28 WARNING input file was deleted: E:\IIS Logs\W3SVC1\u_ex181224.log

All of the above is leading me to believe the file_remove procedure does not support wildcards in the name.

Does anyone have any experience with this?

Anyone have a suggestion on how I can implement the above? Ideally, I would like to pass in the IIS Logs parent folder and recursively delete files older than 7 days in all sub-folders.

Using nxlog-ce-2.10.2150

Many thanks

Stephen

AskedJanuary 2, 2019 - 7:34pm

Answer (1)

6048000 = 70days correct?
I think you are looking to use 604800 for 7 days.
72460*60=604800

That could be the reason you aren't seeing what you are expecting.

Edit:
As far as deleting files in subfolders. As you noticed, we do not support * in the path, only the name. You could leverage xm_exec though and use a built in Microsoft command like forfiles -p "E:\IIS Logs\W3SVC1" -s -m *.log /D -7 /C "cmd /c del @path"
Though I would change the command to "cmd /c echo @path" first just so you can see what it would delete first (make sure the command is accurate as I haven't tested this).

Similar example on a Linux box.

<Extension exec>
    Module  xm_exec
    <Schedule>
        When    @daily
        Exec    exec_async("/usr/bin/find", "/opt/nxlog/Output", "-mtime", "+7", "-type", "f", "-delete");
    </Schedule>
</Extension>

Comments (1)

  • stephen's picture

    Hi Zhengshi

    Many thanks for the reply.

    You are correct - 604800 for 7 days. I was using 604800 in my testing - 6048000 was a typo in my post.

    To confirm, I ran the following test:

    <Schedule>
    Every 10 sec
    Exec log_info(now() - 604800);
    Exec log_info(now() - 6048000);
    </Schedule>

    Logfile entries:

    2019-01-02 23:31:21 INFO nxlog-ce-2.10.2150 started
    2019-01-02 23:31:21 INFO 2018-12-26 23:31:21
    2019-01-02 23:31:21 INFO 2018-10-25 00:31:21

    Either way, I will look into using xm_exec with either a cmd or powershell command to traverse the sub-folders, as this would be an optimal solution for me.

    I will keep you posted.

    Regards

    Stephen