0

Is this even possible to do in rsyslog?

http://www.rsyslog.com/doc/rsyslog_conf_output.html

This syntax is not working:

mail.*              -/var/log/mail.log:300M

I need to set this limitation in rsyslog instead of logrotate because the log can quickly fill up the partition in case of some error (even before it would get to logrotate next day) with high traffic mail system.

Diamond
  • 9,001
  • 3
  • 24
  • 38
defiler
  • 11
  • 1
  • 2

1 Answers1

6

First of all, according to the document you linked to, your syntax is wrong as the arguments to $outchannel should be given separated by commas, so something like

$outchannel mail,/var/log/mail.log, 300000000,/path/to/rotate/script

would be more correct.

Second, outchannel triggers some script on reaching max-size. It doesn't just stop writing, but it runs a script and checks again. So you'll still need a script that reduces the size of the logfile once it was triggered.

I think you misunderstand the outchannel command itself, and you didn't properly read the document you linked to, as it explicitely states:

The max-size must always be specified in bytes - there are no special symbols (like 1k, 1m,...) at this point of development.

Diamond
  • 9,001
  • 3
  • 24
  • 38
BeerSerc
  • 499
  • 3
  • 6