In rsyslog, how can I trigger an hourly email aggregating entries in one of our logs?

Question

One of our apps has been configured to log certain errors to a log on a remote server using rsyslog. I've been asked to provide an hourly email that lists the errors logged within the last hour. I've looked at ommail, but it doesn't seem to do exactly this. Any suggestions on how best to do this?

Answer 1

I would go low tech on this:

• put error messages in a separate file like

*.error /var/log/error.log

• then rotate it hourly via logrotate

From logrotate, you can run a script in the prerotate or postrotate part, where you can take the contents of the file and send them via Email.

ommail is more for sending logs matching a certain filter, so it would be hacky to make it send such "digests".