Fixed filename with rolling archive files

[bartkusters]

When logging rolls, all new entries are written to the rolled file. Can't this be changed so that logging keeps getting written to "sample.log" and the rolled files "sample001.log", "sample002.log", etc. keep the history?

[hali4831]

This is something I am looking for too

[jawadatgithub]

Me too, to explain the benefit of that, I usually open the log.txt in notepad++ to keep monitoring current logs, and in case of issue happened while ago, I go to rolled file based on last modified date.

So most of the times I just need to have log.txt opened, and rarely check rolled files. and that's the default behavior used in nlog, but for .net core 2 apps I still prefer serilog.

[bitchkat]

I was actually just going to ask about this exact same behavior. The way that bartkusters describes is very traditional -- at least in the linux/unix world. If I'm tailing a log file, it just silently stops when the log file rolls over. Also you have to ls all the files to find the last one to start a tail when the log file has been rolled over.

[nblumhardt]

Thanks for all the input 👍

Is anyone interested in exploring this one a bit further, to see what the implementation effort would involve, and how the file logger would need to change in order to incorporate this scenario?

[nblumhardt]

See also some earlier discussion in: serilog/serilog-sinks-rollingfile#26

[bartelink]

While its true that log4net and NLog both do rolling renaming stuff as described (at least by default), I'd like to point out the following reasons to maintain [at a minimum, backcompat with] the status quo:

• I've seen cases where that's problematic (e.g. backup, viewing or AV software can block a rolling set of renames)
• doing such a rename in the context of concurrent writing to a shared resource is fraught with danger and hard to implement in a safe way
• log forwarders in general (and def Splunk one) needs to go to effort to fingerprint content to keep track of it all (and it's messy for tailing tools to cope with too - though I guess most proper ones can handle it)
• Splunk and/or other files can not track the renamed state of the file whereas this scheme keeps it all predictable - if I want to track back to a source file it's there as long as it has not been aged out.

For me, starting Visual Studio Code with code /logs where that's my log folder and then clicking from file to file works pretty effectively (recent versions are pretty snappy and seem to handle files changing properly, and of course pretty prints it pretty nicely indeed) and lets me get perspective on how much writing happened and when vs having to infer stuff from file dates etc etc.

But... the reason I'm here is to ask for a feature/tweak... @nblumhardt or others, is anyone interested in having rolling by size trigger usage of suffix universally? i.e. if the name requested is x/app.log then the first file written will be x/app_000.log. This would make it easier to explain a naming pattern to someone ingesting and/or avoid surprises vs having to explain the special casing. While not trivial, it does not look crazy difficult to impl based on the current code.

[nblumhardt]

@bartelink the _000 naming makes sense - the only drawback is that we would risk breaking existing apps by making it the default, and yet it seems too minor to warrant a new top-level configuration option.

To move this sink forward, we might need a means of plugging in naming/rolling policies - tricky work, but probably inevitable. Low on time, but happy to help out if anyone is interested in writing up an API proposal.

[vatara]

I have a similar need, I want the fixed filename, but don't care about the past logs. I made the change here: vatara@6bccc72

It adds a trimFileSizeBytes option. When the file reaches the fileSizeLimitBytes size, it trims the file down to the trimFileSizeBytes size keeping the end(most recent) part of the file. This way it's not trimming the log every time you write to it.

There's a couple issues with my changes. I used a int? for trimFileSizeBytes, instead of a long? like fileSizeLimitBytes, because when it truncates the file, FileStream.Read takes int, not long. I also had to remove readonly from a few FileSink members to allow closing and re-opening the stream.

It would be great to have a feature like this officially.

[joshuaboniface]

I'm also very interested in this. We're using Serilog file sink in https://github.com/jellyfin/jellyfin, and to package for Debian I'd like this to work like syslog does by default, that is, on-roll move jellyfin.log to jellyfin.log.0 (and up the chain), then continue writing to jellyfin.log. We would care about the history in this case. Is it possible to implement this with the current code/config options (the readme isn't clear), or would a feature be required?

[bartelink]

@joshuaboniface log4net etc also implement that renaming strategy. IME it can also be highly problematic - the race implicit in multiple writers is one reason, but also file locking from backups etc. can interfere with the process too. I'd suggest most other users feel the same (I don't recall this being asked for by anyone in the last year for instance) and hence the complexity introduced by having two modes would be unwarranted. The fact that the naming of the first file in the series is inconsistent would be nice to fix to make it more intuitive though.