Logs Roll over

Question

When will the logs in IronPort Appliance be rolled over?

Answer 1

The mechanism for deciding when something is to be rolled over is currently defined by the filesize of the message. For example, if you set the mfc_logs to have 20 files with 5 mb per file, then the log would automatically roll over once the 5mb filesize is reached and delete old log files to make room for new logs.
Unless there's a feature request, the only way to get it to rollover around midnight/end of day is to ftp into the mfc_log file directory. Get an estimate of how many log files pertain to one day. So, it one day on average uses up 3 log files at 5mb each for one day of traffic, then you can say that one day of log uses about 15mb. So, if you set each log file to be 15mb, then one log file should pertain to one day worth of traffic.
You may need to examine your current mail volume/traffic to see the exact numbers but that should be the general idea.
Note, if one day is 250mb, then this won't work since the maximum log file can only be 100mb.
I like the rollover now but without having MFC I would like to have these logs broken up by day. Can we schedule the rollover now to occur every night at midnight? I do not see a way to schedule anything but I could be missing it.