Input File Log Rotation

NXLog has decent ability to rotate it's own output files, but it's doesn't come with a lot of methods to rotate input files - i.e. your reading in Accounting logs from a windows RADIUS and it would be nice to archive those with nxlog while you're at it. You could bust out some perl (if you're on unix) and use the xm_perl module, but there's a simpler way.

On windows, the solution is to use an exec block with a scheduled command - the forfiles executable is already present in windows and does the trick. The only gotcha is that ALL the parameters must be delimited like below.

So the command 

forfiles /P "E:\IAS_Logs" /D -1 /C "cmd /c move @file \\server\share"

Becomes 

<Extension exec>
  Module xm_exec
  <Schedule>
    When @daily
Exec exec('C:\Windows\System32\forfiles.exe','/P','"E:\IAS_Logs"','/D','-1','/C','"cmd','/c','move','@file','\\server\share"');
  </Schedule>
</Extension>

A slightly more complex example with added compression and removal of old files (there isn't a great command line zip utility for windows in advance of powershell 5)


# Add log rotation for the windows input files
<Extension exec>
    Module xm_exec
    <Schedule>
    When @daily
        # Make a compressed copy of .log files older than 1 day
        Exec exec('C:\Windows\System32\forfiles.exe','/P','"E:\IAS_Logs"','/M','*.log','/D','-1','/C','"cmd','/c','makecab','@file"')
        # Delete original files after 2 days, leaving the compressed copies 
        Exec exec('C:\Windows\System32\forfiles.exe','/P','"E:\IAS_Logs"','/M','*.log','/D','-2','/C','"cmd','/c','del','@file"')
        # Move compressed files to the depot after 2 days
        Exec exec('C:\Windows\System32\forfiles.exe','/P','"E:\IAS_Logs"','/M','*.lo_','/D','-2','/C','"cmd','/c','move','@file','\\shared.ohio.edu\appshare\radius\logs\radius1.oit.ohio.edu"');
    </Schedule>
</Extension>

The @daily runs right at 0 0 0 0 0 (midnight every night). Check the manual for more precise cron controls

Comments