ansible/roles/rsyslog/tasks/archival.yaml

---
- name: disable default rules
  set_fact:
    rsyslog_default_rules_state: absent
  when: rsyslog_archival_format_enabled

- name: find default log files
  find:
    path: /var/log
    file_type: file
    pattern: "{{ rsyslog_default_log_patterns }}"
  when: rsyslog_archival_format_enabled
  register: default_log_files

-  name: delete files
   file:
     path: "{{ item.path }}"
     state: "{{ rsyslog_archival_format_enabled | ternary('absent', 'file') }}"
   when: rsyslog_archival_format_enabled
   with_items: "{{ default_log_files.files }}"

- name: delete logrotate configuration
  file:
    path: /etc/logrotate.d/rsyslog
    state: absent
  when: rsyslog_archival_format_enabled

- name: configure archival format
  template:
    src: archival.conf.j2
    dest: /etc/rsyslog.d/10-archival.conf
    owner: root
    group: root
    mode: 0644
  notify: restart rsyslog
  when: rsyslog_archival_format_enabled

- name: manage archive rules
  file:
    path: /etc/rsyslog.d/10-archival.conf
    state: "{{ rsyslog_archival_format_enabled | ternary('file', 'absent') }}"

- name: compress log cron job
  cron:
    name: compress syslog
    minute: "0"
    hour: "1"
    user: root
    job: find /var/log/syslog/ -type f ! -name "*$(date +\%Y\%m\%d)*.log" -name "*.log" -exec xz {} \;
    state: "{{ rsyslog_archival_format_enabled | ternary('present', 'absent') }}"