Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
Modify /etc/logrotate.d/rsyslog to archive log files to BigStash
# Read more at http://blog.bigstash.co/2015/05/25/log-archiving-using-logrotate-and-bigstash/
/var/log/syslog
{
rotate 7
daily
missingok
notifempty
delaycompress
compress
postrotate
TAG=rsyslog # Set this to something that will help you identify your archives.
ROTATE=7 # This must be the same value used for "rotate" in the previous lines.
ARCHIVE_TITLE=`hostname`-$TAG-`date +"%Y-%m-%d-%H-%M"`
COUNTER_FILE=/var/lib/logrotate/$TAG.count
FILELIST=""
COUNT=0 ; [ -f $COUNTER_FILE ] && COUNT=$(cat $COUNTER_FILE)
[ "$COUNT" -eq "0" ] && {
for f in $@; do
stat -t "$f".* >/dev/null 2>&1 && [ $? -eq 0 ] && FILELIST="$FILELIST $f.*"
done
bgst put --silent --dont-wait --title $ARCHIVE_TITLE $FILELIST
}
COUNT=$((COUNT+1))
[ "$COUNT" -eq "$ROTATE" ] && COUNT=0
echo $COUNT > $COUNTER_FILE
reload rsyslog >/dev/null 2>&1 || true
endscript
}
/var/log/mail.info
/var/log/mail.warn
/var/log/mail.err
/var/log/mail.log
/var/log/daemon.log
/var/log/kern.log
/var/log/auth.log
/var/log/user.log
/var/log/lpr.log
/var/log/cron.log
/var/log/debug
/var/log/messages
{
rotate 4
daily
missingok
notifempty
compress
delaycompress
sharedscripts
postrotate
TAG=rsyslog-other # Set this to something that will help you identify your archives.
ROTATE=4 # This must be the same value used for "rotate" in the previous lines.
ARCHIVE_TITLE=`hostname`-$TAG-`date +"%Y-%m-%d-%H-%M"`
COUNTER_FILE=/var/lib/logrotate/$TAG.count
FILELIST=""
COUNT=0 ; [ -f $COUNTER_FILE ] && COUNT=$(cat $COUNTER_FILE)
[ "$COUNT" -eq "0" ] && {
for f in $@; do
stat -t "$f".* >/dev/null 2>&1 && [ $? -eq 0 ] && FILELIST="$FILELIST $f.*"
done
bgst put --silent --dont-wait --title $ARCHIVE_TITLE $FILELIST
}
COUNT=$((COUNT+1))
[ "$COUNT" -eq "$ROTATE" ] && COUNT=0
echo $COUNT > $COUNTER_FILE
reload rsyslog >/dev/null 2>&1 || true
endscript
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment