From e72fa66ad26b93c77d92e7697521cb0c92549c30 Mon Sep 17 00:00:00 2001 From: AshFungor Date: Thu, 16 Oct 2025 19:19:52 +0300 Subject: [PATCH 1/3] log rotation: add new builtin rotation method Signed-off-by: AshFungor --- README.md | 2 +- .../070_Destinations/040_File/README.md | 2 +- .../004_Configuring_log_rotation.md | 43 ++++++++++++------- 3 files changed, 30 insertions(+), 17 deletions(-) diff --git a/README.md b/README.md index 7d1ac0e8..9dc1ce97 100644 --- a/README.md +++ b/README.md @@ -14,7 +14,7 @@ This repository part contains the source code of `The syslog-ng OSE Administrati ## [Developer guide](https://syslog-ng.github.io/dev-guide/README) -Do you like adding your idea, bug-fix to the fabolous syslog-ng? Help others to do the same, share your knwowledge in the [developer guide](https://syslog-ng.github.io/dev-guide/README). +Do you like adding your idea, bug-fix to the fabulous syslog-ng? Help others to do the same, share your knowledge in the [developer guide](https://syslog-ng.github.io/dev-guide/README). ## [Generated document](https://syslog-ng.github.io/) diff --git a/doc/_admin-guide/070_Destinations/040_File/README.md b/doc/_admin-guide/070_Destinations/040_File/README.md index 91d7022b..93a97f07 100644 --- a/doc/_admin-guide/070_Destinations/040_File/README.md +++ b/doc/_admin-guide/070_Destinations/040_File/README.md @@ -45,7 +45,7 @@ destination d_file { **NOTE:** When using this destination, update the configuration of your log rotation program to rotate these files. Otherwise, the log files can -become very large. +become very large. See [[Configuring log rotation]] for available options. {: .notice--info} Also, after rotating the log files, reload {{ site.product.short_name }} using the diff --git a/doc/_admin-guide/180_Best_practices_and_examples/004_Configuring_log_rotation.md b/doc/_admin-guide/180_Best_practices_and_examples/004_Configuring_log_rotation.md index 4c3cfffc..5ccbc7be 100644 --- a/doc/_admin-guide/180_Best_practices_and_examples/004_Configuring_log_rotation.md +++ b/doc/_admin-guide/180_Best_practices_and_examples/004_Configuring_log_rotation.md @@ -2,11 +2,32 @@ title: Configuring log rotation id: adm-pract-rotate description: >- - The {{ site.product.short_name }} application does not rotate logs by itself. This chapter - describes how to use {{ site.product.short_name }} for log rotation. + This chapter describes how to use {{ site.product.short_name }} for log rotation, making use of builtin options + and external tools. --- -Consider the following approaches: +Log rotation is traditionally only applicable to files and, consequently, +to file destination drivers in {{ site.product.short_name }}. Consider the following approaches: + +## Use builtin logrotate() option of file destination driver + +- It is available starting with {{ site.product.short_name }} version 4.10 or later. + +- It is performed based on file sizes. + +- No additional configuration files are required - log rotation is configured + with the rest of {{ site.product.short_name }}. For details, see [[file() destination options]]. + +## Separate incoming logs based on time, host or other information + +- It is ideal for central log servers, where regular restart of + {{ site.product.short_name }} is unfavorable. + +- Requires shell scripts or cron jobs to remove old logs. + +- It can be done by using macros in the destination name (in the + filename, directory name, or the database table name). (For details + on using macros, see Templates and macros) ## Use logrotate together with {{ site.product.short_name }} @@ -20,23 +41,15 @@ Consider the following approaches: - Requires frequent restart ({{ site.product.short_name }} must be reloaded/restarted when the files are rotated). After rotating the log files, reload {{ site.product.short_name }} using the **syslog-ng-ctl reload** command, or use - another method to send a SIGHUP to {{ site.product.short_name }}. + another method to send a SIGHUP to {{ site.product.short_name }}. Alternatively, + starting from {{ site.product.short_name }} version 3.13 or later **syslog-ng-ctl reopen** + may be used to signal file destination drivers to open log files again without stopping + or interrupting the rest of configured log pipes. - The statistics collected by {{ site.product.short_name }}, and the correlation information gathered with Pattern Database, are lost with each restart. -## Separate incoming logs based on time, host or other information - -- It is ideal for central log servers, where regular restart of - {{ site.product.short_name }} is unfavorable. - -- Requires shell scripts or cron jobs to remove old logs. - -- It can be done by using macros in the destination name (in the - filename, directory name, or the database table name). (For details - on using macros, see Templates and macros - ### Example: File destination for log rotation This sample file destination configuration stores incoming logs in files From e913bf192c4094c74698c4d0f689a262a22e082c Mon Sep 17 00:00:00 2001 From: AshFungor Date: Mon, 20 Oct 2025 19:38:01 +0300 Subject: [PATCH 2/3] log rotation: prefer reopen over reload/restart Signed-off-by: AshFungor evgenynarkhov2@gmail.com --- .../004_Configuring_log_rotation.md | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/doc/_admin-guide/180_Best_practices_and_examples/004_Configuring_log_rotation.md b/doc/_admin-guide/180_Best_practices_and_examples/004_Configuring_log_rotation.md index 5ccbc7be..1732d1e4 100644 --- a/doc/_admin-guide/180_Best_practices_and_examples/004_Configuring_log_rotation.md +++ b/doc/_admin-guide/180_Best_practices_and_examples/004_Configuring_log_rotation.md @@ -38,13 +38,12 @@ to file destination drivers in {{ site.product.short_name }}. Consider the follo - Less scripting is required, only logrotate has to be configured correctly. -- Requires frequent restart ({{ site.product.short_name }} must be reloaded/restarted - when the files are rotated). After rotating the log files, reload +- Starting from {{ site.product.short_name }} version 3.13 or later **syslog-ng-ctl reopen** + must be used to signal file destination drivers to open log files again without stopping + or interrupting the rest of configured log pipes. Alternately, {{ site.product.short_name }} can + be reloaded/restarted when the files are rotated. After rotating the log files, reload {{ site.product.short_name }} using the **syslog-ng-ctl reload** command, or use - another method to send a SIGHUP to {{ site.product.short_name }}. Alternatively, - starting from {{ site.product.short_name }} version 3.13 or later **syslog-ng-ctl reopen** - may be used to signal file destination drivers to open log files again without stopping - or interrupting the rest of configured log pipes. + another method to send a SIGHUP to {{ site.product.short_name }} - The statistics collected by {{ site.product.short_name }}, and the correlation information gathered with Pattern Database, are lost with each From 7b587a0bbcf7a7407b8426d2721304ba7028e775 Mon Sep 17 00:00:00 2001 From: AshFungor Date: Tue, 28 Oct 2025 17:34:24 +0300 Subject: [PATCH 3/3] links: remove redundant square brackets Signed-off-by: AshFungor evgenynarkhov2@gmail.com --- doc/_admin-guide/070_Destinations/040_File/README.md | 2 +- .../004_Configuring_log_rotation.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/doc/_admin-guide/070_Destinations/040_File/README.md b/doc/_admin-guide/070_Destinations/040_File/README.md index 93a97f07..8d344381 100644 --- a/doc/_admin-guide/070_Destinations/040_File/README.md +++ b/doc/_admin-guide/070_Destinations/040_File/README.md @@ -45,7 +45,7 @@ destination d_file { **NOTE:** When using this destination, update the configuration of your log rotation program to rotate these files. Otherwise, the log files can -become very large. See [[Configuring log rotation]] for available options. +become very large. See Configuring log rotation for available options. {: .notice--info} Also, after rotating the log files, reload {{ site.product.short_name }} using the diff --git a/doc/_admin-guide/180_Best_practices_and_examples/004_Configuring_log_rotation.md b/doc/_admin-guide/180_Best_practices_and_examples/004_Configuring_log_rotation.md index 1732d1e4..95b87131 100644 --- a/doc/_admin-guide/180_Best_practices_and_examples/004_Configuring_log_rotation.md +++ b/doc/_admin-guide/180_Best_practices_and_examples/004_Configuring_log_rotation.md @@ -16,7 +16,7 @@ to file destination drivers in {{ site.product.short_name }}. Consider the follo - It is performed based on file sizes. - No additional configuration files are required - log rotation is configured - with the rest of {{ site.product.short_name }}. For details, see [[file() destination options]]. + with the rest of {{ site.product.short_name }}. For details, see file() destination options. ## Separate incoming logs based on time, host or other information