On Wed, 21 Dec 2016, mostolog--- via rsyslog wrote:
To contextualize:
A server is generating multiple log files and sending them using RELP to a
Rsyslog relay. I would love to automatically delete older logs files if they
are already sent/acknowledged.
Is there a way to make Rsyslog delete a file after successfully sending it
via RELP? (and not modified in the last...day?)
Is there an easy way to know, outside from Rsyslog, if a file has already
been processed/sent, in order to delete the local file?
Maybe an script which gets "reading offset" from state file and compares with
file size...
Rsyslog can't really know when a file isn't going to be written to any longer.
It doesn't even know if another program has the file open to write to now.
In your situation, I would use a script with logger to write the messages to
/dev/log for rsyslog to process. By spec, the write to /dev/log will not
complete until rsyslog has the message in it's queue. So your script can feed
the log to rsyslog and remove it immediatly after it's completed.
I'd put in an enhancement request for an option to imfile to delete files when
it's finished reading them. It was created with the assumption that it's reading
the file as it's being written, but I can see useful cases where the files are
made available to rsyslog (mv into a watched directory) after they are complete.
David Lang
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
