Firstly, that's not strictly rsyslog-related so it's a bit off-topic.
But, logrotate handles files, not directories. So your definition of
/var/log/HOSTS/*/* would match, for example
/var/log/HOSTS/whatever/file.log but will not match
/var/log/HOSTS/whatever/2020/06/12/file.log.
Also probably (I haven't tested it but I have a strong feeling it would
work this way) running logrotate with even appropriate number of
wildcards would result in it rotating files separateli in each
directory. So the file /var/log/HOSTS/whatever/2020/06/12/file.log would
get rotated to file.log.1, then file.log.2 and so on (possibly
compressed in the meanwhile) but that's kinda silly.
I think you'd rather want either to put more files in a single directory
(for example - a dir per host approach) and write to a single file (or
single file per syslog facility or whatever approach you have to
splitting the syslog data) and let rsyslog handle the file rotation or
retain your setup and use find with -ctime directive to find old enough
files and delete them. Keep in mind however that find can be tricky
because you may have to be precise with -mindepth and -maxdepth in order
not to delete whole month or even whole year directories. Another
approach is of course just to delete files (with -type f) but that'll
leave you with empty directories.
Mariusz Kruk
Ekspert ds. Bezpieczeństwa IT
COMP S.A.
Pion Cyberbezpieczeństwa i Zarządzania Ryzykiem
e-mail: [email protected]
e-mail: [email protected]
tel: +48 608 623 299
On 16.06.2020 09:36, Suhail Siddiqui, HCL via rsyslog wrote:
Here is my config
[root@l00lnx1130 ~]# cat etc/
[root@l00lnx1130 ~]# cat /etc/logrotate.d/syslog
/var/log/cron
/var/log/maillog
/var/log/messages
/var/log/secure
/var/log/spooler
{
missingok
sharedscripts
postrotate
/bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null ||
true
endscript
}
[root@l00lnx1130 ~]# cat /etc/logrotate.d/remote
/var/log/HOSTS/*/*
{
rotate 60
daily
missingok
compress
}
[root@l00lnx1130 ~]#
Best Regards,
Suhail Siddiqui
Service Delivery - Datacenter Services
HCL Technologies Ltd. - UPM Partner for IT Services
Mob: +91-9717193941
-----Original Message-----
From: rsyslog <[email protected]> On Behalf Of Suhail Siddiqui,
HCL via rsyslog
Sent: 16 June 2020 10:34
To: Eero Volotinen <[email protected]>; rsyslog-users
<[email protected]>
Cc: Suhail Siddiqui, HCL <[email protected]>
Subject: Re: [rsyslog] wanted to delete logs older then 90 day
If you cab help me I did but not working for me?
Best Regards,
Suhail Siddiqui
Service Delivery - Datacenter Services
HCL Technologies Ltd. - UPM Partner for IT Services
Mob: +91-9717193941<%20%20>
________________________________
From: Eero Volotinen <[email protected]>
Sent: Tuesday, 16 June, 2020 12:59 pm
To: rsyslog-users
Cc: Suhail Siddiqui, HCL
Subject: Re: [rsyslog] wanted to delete logs older then 90 day
Well.
Just configure logrorate correctly.. it can also compress logfiles.
Eero
On Tue, Jun 16, 2020 at 10:25 AM Suhail Siddiqui, HCL via rsyslog
<[email protected]<mailto:[email protected]>> wrote:
Hi ,
My syslog servers stores remote log in this format .
[v766245@l00lnx1130 06]$ pwd
/var/log/HOSTS/system-10.60.28.60/2020/06
[v766245@l00lnx1130 06]$ ll
total 0
drwxr-xr-x. 2 root root 26 Jun 12 15:48 12 drwxr-xr-x. 2 root root 26 Jun 13
00:02 13 drwxr-xr-x. 2 root root 26 Jun 14 00:01 14 drwxr-xr-x. 2 root root 26
Jun 15 00:00 15 drwxr-xr-x. 2 root root 26 Jun 16 00:05 16
[v766245@l00lnx1130 06]$
I wanted to delete any logs older then 90 days , when try with find command it
will delete all the old years and current years/month directory , please help
me to fix this to maintain the space utilization.
Best Regards,
Suhail Siddiqui
Service Delivery - Datacenter Services
HCL Technologies Ltd. - UPM Partner for IT Services
Mob: +91-9717193941<%20%20>
________________________________
Please note. The information contained in this message is confidential and is
intended only for the use of the individual named above and others who have
been specially authorized to receive it. If you are not the intended recipient,
you are hereby notified that any dissemination, distribution or copying of this
communication is strictly prohibited. The attachments have been scanned for
viruses prior to leaving our E-mail system. UPM-Kymmene Corporation shall not
be liable for any consequences of any virus being passed on.
_______________________________________________
rsyslog mailing list
https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.adiscon.net%2Fmailman%2Flistinfo%2Frsyslog&data=02%7C01%7Csuhail.siddiqui%40visitor.upm.com%7C15ca1f82325641894a1008d811c7a63c%7C9eab37f091c647e39c00fe8544bd272e%7C0%7C0%7C637278896475421843&sdata=H8CEOMmtSnvDqi4gH17%2FPEWunTOAORL3JhiSDYTo%2Fcc%3D&reserved=0<https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.adiscon.net%2Fmailman%2Flistinfo%2Frsyslog&data=02%7C01%7Csuhail.siddiqui%40visitor.upm.com%7C15ca1f82325641894a1008d811c7a63c%7C9eab37f091c647e39c00fe8544bd272e%7C0%7C0%7C637278896475421843&sdata=H8CEOMmtSnvDqi4gH17%2FPEWunTOAORL3JhiSDYTo%2Fcc%3D&reserved=0>
https://eur03.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.rsyslog.com%2Fprofessional-services%2F&data=02%7C01%7Csuhail.siddiqui%40visitor.upm.com%7C15ca1f82325641894a1008d811c7a63c%7C9eab37f091c647e39c00fe8544bd272e%7C0%7C0%7C637278896475421843&sdata=GvO%2BEdErNjO04q8Raojw0ze%2B6xJFKux26eXrD2vf5AM%3D&reserved=0<https://eur03.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.rsyslog.com%2Fprofessional-services%2F&data=02%7C01%7Csuhail.siddiqui%40visitor.upm.com%7C15ca1f82325641894a1008d811c7a63c%7C9eab37f091c647e39c00fe8544bd272e%7C0%7C0%7C637278896475421843&sdata=GvO%2BEdErNjO04q8Raojw0ze%2B6xJFKux26eXrD2vf5AM%3D&reserved=0>
What's up with rsyslog? Follow
https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftwitter.com%2Frgerhards&data=02%7C01%7Csuhail.siddiqui%40visitor.upm.com%7C15ca1f82325641894a1008d811c7a63c%7C9eab37f091c647e39c00fe8544bd272e%7C0%7C0%7C637278896475421843&sdata=NiDdwN593E3%2FHNL0hylVteu1hFrpAJyQVoOgodG44Z0%3D&reserved=0<https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftwitter.com%2Frgerhards&data=02%7C01%7Csuhail.siddiqui%40visitor.upm.com%7C15ca1f82325641894a1008d811c7a63c%7C9eab37f091c647e39c00fe8544bd272e%7C0%7C0%7C637278896475421843&sdata=NiDdwN593E3%2FHNL0hylVteu1hFrpAJyQVoOgodG44Z0%3D&reserved=0>
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.adiscon.net%2Fmailman%2Flistinfo%2Frsyslog&data=02%7C01%7Csuhail.siddiqui%40visitor.upm.com%7C15ca1f82325641894a1008d811c7a63c%7C9eab37f091c647e39c00fe8544bd272e%7C0%7C0%7C637278896475431839&sdata=ADqpTjGKFRaxTSmj0fyoYEzvcRiKibJuI3o%2BCgWHm%2BA%3D&reserved=0
https://eur03.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.rsyslog.com%2Fprofessional-services%2F&data=02%7C01%7Csuhail.siddiqui%40visitor.upm.com%7C15ca1f82325641894a1008d811c7a63c%7C9eab37f091c647e39c00fe8544bd272e%7C0%7C0%7C637278896475431839&sdata=e94dJVMNICu55yTvXWX95i4bemy%2BhZKGh65ZTeW0NQ4%3D&reserved=0
What's up with rsyslog? Follow
https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftwitter.com%2Frgerhards&data=02%7C01%7Csuhail.siddiqui%40visitor.upm.com%7C15ca1f82325641894a1008d811c7a63c%7C9eab37f091c647e39c00fe8544bd272e%7C0%7C0%7C637278896475431839&sdata=W3R9J7uRtPeetr0wJFfrsPrq7Qo6L4xQvYPQCFluV6s%3D&reserved=0
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
