Trying to delete IIS logs older than X days


#1 stephen

Hello All

Happy New Year!!!

I am trying to delete IIS logs older than 7 days.

I tried using the following:

<Extension _fileop> Module xm_fileop <Schedule> Every 1 day Exec file_remove('E:\IIS Logs\W3SVC1\*.log', (now() - 6048000 )); </Schedule> </Extension>

But the above did not work - the file(s) were not deleted and no entries in the nxlog logfile.

Note: the nxlog-ce documentation states the following regarding wildcard usage:

file_remove(string file); Remove file. It is possible to specify a wildcard in the filename (but not in the path). The backslash () must be escaped if used as the directory separator with wildcards (for example, C:\test\*.log). This procedure will reopen the LogFile if it is removed. An error is logged if the operation fails.

For Debugging purposes, I tried using the following:

<Extension _fileop> Module xm_fileop

<Schedule> Every 1 day Exec if (file_ctime("E:\IIS Logs\W3SVC1\*.log") <= now()) log_info("File is older"); </Schedule> </Extension>

The following entry is in the nxlog logfile:

2019-01-02 18:10:19 ERROR failed to read file creation time on 'E:\IIS Logs\W3SVC1*.log': The filename, directory name, or volume label syntax is incorrect.

Note: Maybe file_cname cannot except wildcards in the filename because if I use the following:

<Schedule> Every 10 sec Exec if (file_ctime("E:\IIS Logs\W3SVC1\u_ex181224.log") <= now()) log_info("File is older"); </Schedule>

Then I receive the following in the nxlog logfile:

2019-01-02 18:23:08 INFO File is older

If I try the following:

<Schedule> Every 10 sec Exec if (file_ctime("E:\IIS Logs\W3SVC1\u_ex181224.log") <= now()) log_info("File is older"); Exec file_remove("E:\IIS Logs\W3SVC1\u_ex181224.log", (now() - 6048000 )); </Schedule>

The following appears in nxlog logfile:

2019-01-02 18:26:26 INFO File is older 2019-01-02 18:26:28 WARNING input file was deleted: E:\IIS Logs\W3SVC1\u_ex181224.log

All of the above is leading me to believe the file_remove procedure does not support wildcards in the name.

Does anyone have any experience with this?

Anyone have a suggestion on how I can implement the above? Ideally, I would like to pass in the IIS Logs parent folder and recursively delete files older than 7 days in all sub-folders.

Using nxlog-ce-2.10.2150

Many thanks

Stephen

#2 Zhengshi Nxlog ✓ (Last updated )
#1 stephen

Hello All

Happy New Year!!!

I am trying to delete IIS logs older than 7 days.

I tried using the following:

<Extension _fileop> Module xm_fileop <Schedule> Every 1 day Exec file_remove('E:\IIS Logs\W3SVC1\*.log', (now() - 6048000 )); </Schedule> </Extension>

But the above did not work - the file(s) were not deleted and no entries in the nxlog logfile.

Note: the nxlog-ce documentation states the following regarding wildcard usage:

file_remove(string file); Remove file. It is possible to specify a wildcard in the filename (but not in the path). The backslash () must be escaped if used as the directory separator with wildcards (for example, C:\test\*.log). This procedure will reopen the LogFile if it is removed. An error is logged if the operation fails.

For Debugging purposes, I tried using the following:

<Extension _fileop> Module xm_fileop

<Schedule> Every 1 day Exec if (file_ctime("E:\IIS Logs\W3SVC1\*.log") <= now()) log_info("File is older"); </Schedule> </Extension>

The following entry is in the nxlog logfile:

2019-01-02 18:10:19 ERROR failed to read file creation time on 'E:\IIS Logs\W3SVC1*.log': The filename, directory name, or volume label syntax is incorrect.

Note: Maybe file_cname cannot except wildcards in the filename because if I use the following:

<Schedule> Every 10 sec Exec if (file_ctime("E:\IIS Logs\W3SVC1\u_ex181224.log") <= now()) log_info("File is older"); </Schedule>

Then I receive the following in the nxlog logfile:

2019-01-02 18:23:08 INFO File is older

If I try the following:

<Schedule> Every 10 sec Exec if (file_ctime("E:\IIS Logs\W3SVC1\u_ex181224.log") <= now()) log_info("File is older"); Exec file_remove("E:\IIS Logs\W3SVC1\u_ex181224.log", (now() - 6048000 )); </Schedule>

The following appears in nxlog logfile:

2019-01-02 18:26:26 INFO File is older 2019-01-02 18:26:28 WARNING input file was deleted: E:\IIS Logs\W3SVC1\u_ex181224.log

All of the above is leading me to believe the file_remove procedure does not support wildcards in the name.

Does anyone have any experience with this?

Anyone have a suggestion on how I can implement the above? Ideally, I would like to pass in the IIS Logs parent folder and recursively delete files older than 7 days in all sub-folders.

Using nxlog-ce-2.10.2150

Many thanks

Stephen

6048000 = 70days correct? I think you are looking to use 604800 for 7 days. 7*24*60*60=604800 That could be the reason you aren't seeing what you are expecting. Edit: As far as deleting files in subfolders. As you noticed, we do not support * in the path, only the name. You could leverage `xm_exec` though and use a built in Microsoft command like `forfiles -p "E:\IIS Logs\W3SVC1" -s -m *.log /D -7 /C "cmd /c del @path"` Though I would change the command to `"cmd /c echo @path"` first just so you can see what it would delete first (make sure the command is accurate as I haven't tested this). Similar example on a Linux box. ``` Module xm_exec When @daily Exec exec_async("/usr/bin/find", "/opt/nxlog/Output", "-mtime", "+7", "-type", "f", "-delete"); ```