Search code examples
rsyslog

In rsyslog, how can I trigger an hourly email aggregating entries in one of our logs?

One of our apps has been configured to log certain errors to a log on a remote server using rsyslog. I've been asked to provide an hourly email that lists the errors logged within the last hour. I've looked at ommail, but it doesn't seem to do exactly this. Any suggestions on how best to do this?

Solution

  • I would go low tech on this:

    • put error messages in a separate file like
    *.error /var/log/error.log

    From logrotate, you can run a script in the prerotate or postrotate part, where you can take the contents of the file and send them via Email.

    ommail is more for sending logs matching a certain filter, so it would be hacky to make it send such "digests".