On Sat, Sep 7, 2013 at 12:10 PM, Erik Steffl <[email protected]> wrote:
> Is there any way to make rsyslog change the filename when it's done > writing to it? > > Well, let me ask a counter-question: how do you think rsyslog can know it is done with a file? In fact, it doesn't know, as whenever it thinks it is done, the very next message may come up with data that invalidates that assumption. So from the rsyslog PoV, a file is never "done", but may be evicted from cache due to not being used frequently enough (but even cache eviction doesn't mean the file will be re-opened again). I agree that with some system properties - mostly $month and friends - rsyslog may be able to get a clue when it is "done". But even there are subtle issue, like DST, where being done based on "$HOUR" isn't really sure at 2:30 in the morning ;). If I were to add a feature for "being done", it would probably materialize around a single fixed-format timestamp property, which would clearly indicate that the same file cannot be used again (but even then people could set the system clock back in time...). Such a feature would probably require a sponsor and may not be as easy to implement as it sounds. Note that e.g. $hour inside a template is not sufficient - e.g. a template "/var/log/mail%$hour$%.log" would never be done, as the same file name would be re-used each 24 hours! Rainer > Our current strategy is to dynamically create files (using omfile and > DynaFile with date/time). > > The obvious solution is to look whether the file is old enough (compare > the date/time in filename to current time). > > Is there a better solution? Ideally I would have rsyslog rename the file > once it's done with it. > > Using logrotate would not work in our case, we need the date/time (and > other information) in the filename, it is used as S3 key. > > thanks! > > erik > ______________________________**_________________ > rsyslog mailing list > http://lists.adiscon.net/**mailman/listinfo/rsyslog<http://lists.adiscon.net/mailman/listinfo/rsyslog> > http://www.rsyslog.com/**professional-services/<http://www.rsyslog.com/professional-services/> > What's up with rsyslog? Follow https://twitter.com/rgerhards > NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad > of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you > DON'T LIKE THAT. > _______________________________________________ rsyslog mailing list http://lists.adiscon.net/mailman/listinfo/rsyslog http://www.rsyslog.com/professional-services/ What's up with rsyslog? Follow https://twitter.com/rgerhards NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
