2

I am using rsyslog 8.2.0, and logging rsyslog's own impstats output to a file. I could not find reference to it - is it possible to limit its size? It could get quite large in a system that runs for a long time...

kubanczyk
  • 13,812
  • 5
  • 41
  • 55
Neomi
  • 23
  • 3

1 Answers1

1

Two ways:

  1. Use log.syslog="on", and then configure the output stream to limit its output to the size you want, or
  2. Use log rotation, e.g. logrotate, to rotate the log when it reaches a given size.
Jenny D
  • 27,780
  • 21
  • 75
  • 114
  • thanks for the quick response. I don't use logrotate, so I went with your first suggestion: I have created a ruleset for the impstats module and in it I used an output channel with a log rotation script. I was not sure if I could use an output channel in a ruleset, but it appears I can :) – Neomi Apr 15 '19 at 08:02
  • Glad it worked for you! – Jenny D Apr 15 '19 at 15:54
  • Just a note, when you most need impstats info during production performance issue analysis, it may be missing because `log.syslog="on"` causes it to use the syslog engine, which is the very thing that could be having reliability problems due to load. Be sure to at least put that stats processing into it's own ruleset and separate queues? – JPvRiel Jun 16 '21 at 10:53