rsyslog Configurations

How to configure rsyslog

Some records of resent works. The point is to test rsyslog's file size limit and log format.

1. Create log format:

Next is to add a new template about system logs.

$ vim /etc/rsyslog.d/test.log

# Define template test_format

$template test_format, "%$year% %msg%\n"

# Apply test_format on test.log.

local3.* /var/log/test.log;test_format

2. Create log rotate rules:

$ vim /etc/logrotate.d/test

/var/log/test.log {
daily
rotate 3
create
size 1M
postrotate
/bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
endscript
}

daily means logrotate every day, but cannot shorter than that defined in crontab.

rotate 3 save 3 logs when rotate, clean the older ones.

create create a new test.log file when rotate.

size 1M when logrotate, if file size isn't reach the value, rotate would not happen.

postrotate commands need to execute after rotate. In former case, which copied from /etc/logrotate.d/syslog, means like to restart rsyslog service. If not, rotate will not happen.

endscript commands end, paired with postrotate.

3. logrotate is scheduled in crontab, by default, it's located in /etc/cron.daily, which means logrotate every day. Even log file size reached the limit, rotate still not happen if it's not the right time.

So if you want a fast logrotate, you need to add it into crontab, like:

$ crontab -e

/1 * /usr/sbin/logrotate  /etc/logrotate.d/test