Does syslog-ng config file support log rotating files every 15 mins?

Question

I using syslog-ng config file destination configuration to create hourly log files. The config I'm using for this is as follows:

destination d_hourly {file("/var/log/tracker/pid$PID-track-$YEAR-$MONTH-$DAY-$HOUR.log");};

I now have a requirement to create files every 15 mins or 30 mins. I looked through the config file macros and there is no such macro (which is on expected lines). Is there a way to write a custom function in syslog-ng config which returns a value based on the current time and which can be suffixed in the destination direction for syslog-ng.

Or is there some other way to achieve this?

Answer 1

You can divide the minute value by a number inline, which will generate separated files. For example:

destination d_half_hourly {file("/var/log/tracker/pid$PID-track-$YEAR-$MONTH-$DAY-$HOUR-$(/ $MIN 30).log");};

Because of integer division, this will put all logs from PID 1000 and date 1/23/2015 05:00 to 05:29 into

/var/log/tracker/pid1000-track-2015-01-23-05-0.log

and from 05:30 to 05:59 into

/var/log/tracker/pid1000-track-2015-01-23-05-1.log

You can also increase the frequency by changing 30 to another divisor.

Answer 2

there is no such built-in function, but in newer syslog-ng versions you can make various numerical comparisons in filters: http://www.balabit.com/sites/default/files/documents/syslog-ng-ose-3.6-guides/en/syslog-ng-ose-v3.6-guide-admin/html/filters-comparing.html

If you combine this with embedded log paths, I think you can create a configuration that does what you need. For example, something like this pseudocode (just to show the idea, it's not syntactically correct):

log { source_mysource
   log { filter(is-$MIN-less-than-15) destination(file("/var/log/tracker/pid$PID-track-$YEAR-$MONTH-$DAY-$HOUR-0-15.log")) }
   log { filter(is-$MIN-between-16-and-30) destination(file("/var/log/tracker/pid$PID-track-$YEAR-$MONTH-$DAY-$HOUR-16-30.log")) }
...
}

HTH,

Regards,

Robert Fekete