2

I want to create a new syslog file each time the system boots and save the old data in another file so that I can detect abnormal behavior on the current boot if any. Is there any configuration for syslogd that can achieve this. Or a crontab job with logrotate should be used to achieve this?

  • couldn't this be done simply by running logrotate from /etc/rc.local? – gogoud Mar 16 '15 at 21:54
  • Won't logrotate will replace the old file on each run? I want two files to be maintained. One will maintain the history of all the runs in syslog.old and the second will save data for a new run in syslog. – hmehra Mar 16 '15 at 22:25
  • no, logrotate can be set to keep lots of old copies, do man logrotate – gogoud Mar 16 '15 at 23:13
  • I do not want multiple files for each run. Just the two files. On each boot it is expected the old file will contain logs for all runs and the new file will contain logs for the current run only – hmehra Mar 16 '15 at 23:35
1

Add these lines (which are intended to be shell-agnostic) to /etc/rc.local, or put them in a script file (preceded by the shebang #!/bin/sh) and put a line to run it in /etc/rc.local.

# find the line number for the (most recent) start of syslog
LOGSTART=$(grep -n "syslog.*start" /var/log/syslog.1|cut -f1 -d:|tail -n1)
# give up if none found
[ -n "$LOGSTART" ] || exit 0
# add preceding lines to the long-term log
sed "$LOGSTART,\$d" /var/log/syslog >>/var/log/syslog.old
# make a copy of the log
cp /var/log/syslog /tmp/syslog
# recreate the active log
sed -n "$LOGSTART,\$p" /tmp/syslog >/var/log/syslog
# remove the copy
rm /tmp/syslog

It might be better to stop syslogd (or rsyslogd or whatever) during this process and restart it after, but I've left that for your homework.

Check first that grep "syslog.*start" /var/log/syslog does indeed find lines marking the startup of your system logger, if not then modify this line appropriately. The log file is sometimes /var/log/messages but presumably not in your case since you mention syslog.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.