Sys Log Configuation.

Log archiving will move the logs from one location to another and, optionally, zip them.  We archive our zipped logs daily at midnight to another drive. These are stored then there are clean-up actions that run to delete files older than the retention requirements. The clean up actions run daily, typically around 6am.

For example, our host logs are archived daily, then deleted after 30 days. When archiving we prepend the ISO date to the hostname(2016-10-17-hostname.txt). Our catchall logs are also archived daily and then deleted after 6 months from the archive location.

We only use log rotation based on size.  We limit each file to 250mb then rotate to a new file. This keeps the file size manageable when needing to open and search.

Thank you kstone

what do you mean by host logs and catchall logs, is not the same logs?

for our environment the logs is like this "SyslogCatchAll-2016-10-17-010.200.018.025", so the IP address is added to the end of the file name. I am sorry that I didn't get your explanation well. is it possible to provide steps is how to do what you explained above. and provide screenshots if possible?

Thanks

We have our default rule(first action), it logs everything to a file called syslogcatchall.txt in D:\syslog\logs. This file is rolled over every 250mb so there may be syslogcatchall.txt.001, syslogcatchall.txt.002, etc. 

Our second action is to log by hostname using the auto-split function.  This then logs to D:\syslog\hostlogs.  These file are also set to roll over every 250mb.

We do this for two reasons, ease of searching for an event on a specific host and that they have different retention times.  We are required to save all log entries for 6 months.  We only keep the hostlogs for 30 days as they are for convenience and not a requirement.

At the end of each day at midnight we archive these to F:\archive\logs and F:\archive\hostlogs respectively with the date prepended to the filename.

Then, every day the clean up tasks run and delete any files outside of the respective retention times for each directory.

now its very clear for me, Thank you very much for you help.