# newsyslog - automaticaly remove unused logfiles



## pmaechler (Jan 23, 2020)

Dear BSD Users

I’m looking for a way to get rid of “abandoned” logfiles.
We are using syslog-ng and are rotating the files with newsyslog

Each client has his own logfile where we get stuff from syslog-ng. The files are in `/var/log/syslog-ng/cpe/<customer>.log`

The newsyslog config line is:
`/var/log/syslog-ng/cpe/*.log              644 10      *   @T00  JG`

Now if a customer is leaving, we still have his log file, which is rotated on a daily basis.

Is there a nice way to tell newsyslog to do-not-create-logfiles? If a new message appears, syslog-ng is creating the file…

Initially I was thinking about deleting all empty files at 23:55 each day. But this may has the drawback that the files `<customer>.0` to `<customer>.9` are left behind (I haven’t tested this)
Deleting all the `<customer>.*` files is also a “bad” idea, since its possible that a client is not sending any logs for some days and I’d like to keep the last events (if they’re within the last 10 days)

Any hints are appreciated


Best regards
Philippe


----------



## SirDice (Jan 23, 2020)

newsyslog(8) doesn't create new logfiles, it only rotates old ones. A new (empty) log file is created by the application (in your case syslog-ng).


----------



## pmaechler (Jan 23, 2020)

Thynk you SirDice for the fast reply!

hmm strange, the first line in those "empty" files is:
`Jan 23 00:00:00 CustomerSyslog newsyslog[74654]: logfile turned over`
this indicates, that newsyslog has created the file

The newsyslog() man-pages mentions in the description that:

```
... When it is executed it archives log files if necessary. If a log file is determined to require archiving, newsyslog rearranges the files so that "logfile" is empty,
```
I'm not a native english speaker, but this I understand, that newsyslog creates an empty "logfile" (I'm wondering who or what writes the `logfile turned over` line...


----------



## SirDice (Jan 23, 2020)

Argh, yes. You're correct. That's what I get when I try to do different things at the same time (moderating here while tackling issues at work).


----------

