You can also roll them over on-demand by running the "rollovernow" command.

c10> help rollovernow

rollovernow logname

    Roll over a log file.

    logname - The name of the log subscription to roll over.
              Use "ALL" to roll over all log files.

Also, with respect to mail_logs and the frequency of updating the MFC application, here are some good practices.


1. Create a separate log on the Ironport appliance solely for MFC purposes.

By default, the "mail_logs" are 95 MB in size. That is not optimal for importing into the MFC program. Also, depending upon your mail volume, 95 mb may take awhile to fill up a log.

The recommendation is to create another log on the Ironport appliance.

- Go to "System Administration > Log Subscriptions"
- Click on "Add new log", select the "Ironport Text Mail Logs" type
- Enter the log name to be "mfc_logs"
- Set the size of the log to be, 10 MB in size. This is optimal for importing into the MFC database and will allow the MFC program to be more current on mail transactions.
- Maximum Number of Files: 20
- The other values are fine as default values and can be kept as is.

2. In your MFC application, when it prompts for the log name, use "mfc_logs".
See #1 above.


By creating a smaller MFC log, it would automatically rollover more quickly. Your MFC program would be more up-to-date. You would be able to go back further in time since the mail_logs are still 95mb in size.

I like the rollover now but without having MFC I would like to have these logs broken up by day. Can we schedule the rollover now to occur every night at midnight? I do not see a way to schedule anything but I could be missing it.

The mechanism for deciding when something is to be rolled over is currently defined by the filesize of the message. For example, if you set the mfc_logs to have 20 files with 5 mb per file, then the log would automatically roll over once the 5mb filesize is reached and delete old log files to make room for new logs.

Unless there's a feature request, the only way to get it to rollover around midnight/end of day is to ftp into the mfc_log file directory. Get an estimate of how many log files pertain to one day. So, it one day on average uses up 3 log files at 5mb each for one day of traffic, then you can say that one day of log uses about 15mb. So, if you set each log file to be 15mb, then one log file should pertain to one day worth of traffic.

You may need to examine your current mail volume/traffic to see the exact numbers but that should be the general idea.

Note, if one day is 250mb, then this won't work since the maximum log file can only be 100mb.

I like the rollover now but without having MFC I would like to have these logs broken up by day. Can we schedule the rollover now to occur every night at midnight? I do not see a way to schedule anything but I could be missing it.

David,
you can use ssh and a cron job to automaticly start a rollover form the cli at midnight.

Jörg