3
responses

Using one dedicated NXlog node as master collector that forwards logs to SIEM, I also dump all logs into a file and I rotate that file weekly, keeping 4 weeks worth of logs on the collector; this very clean setup is taken from the documentation and I like it - it works well (see Log rotate in documentation, example 103). Problem is: This consumes much disk, so I'll need to compress the rotated file. Can I add compression to that output to compress the rotate-copy? I'd prefer not using the example 113 in said log-rotation documentation page.

AskedNovember 3, 2020 - 12:39pm

Answer (1)

Hello,

what makes the way proposes in Example 113 not working for you? That's probably the best way to approach your task.

If you share your limitations - maybe we'll find a workaround.

Regards,

Rafal

Comments (2)

  • DS_534595's picture

    Thanks for reply Rafal,

    it is not a matter of limitations as such but I'd think that it would for example be a natural feature using file_cycle() to add e.g . -z or some similar argument to add compression directly to said function; it is imo a shortcoming to this otherwise great setup to maintain the rotation/retention and file naming of custom output files. If example 113 is the (only) recommended method, then I'll go with that, together with example 114 to do the housekeeping,