I want to create a new syslog file each time the system boots and save the old data in another file so that I can detect abnormal behavior on the current boot if any. Is there any configuration for syslogd that can achieve this. Or a crontab job with logrotate should be used to achieve this?
Add these lines (which are intended to be shell-agnostic) to
/etc/rc.local, or put them in a script file (preceded by the shebang
#!/bin/sh) and put a line to run it in
# find the line number for the (most recent) start of syslog LOGSTART=$(grep -n "syslog.*start" /var/log/syslog.1|cut -f1 -d:|tail -n1) # give up if none found [ -n "$LOGSTART" ] || exit 0 # add preceding lines to the long-term log sed "$LOGSTART,\$d" /var/log/syslog >>/var/log/syslog.old # make a copy of the log cp /var/log/syslog /tmp/syslog # recreate the active log sed -n "$LOGSTART,\$p" /tmp/syslog >/var/log/syslog # remove the copy rm /tmp/syslog
It might be better to stop syslogd (or rsyslogd or whatever) during this process and restart it after, but I've left that for your homework.
Check first that
grep "syslog.*start" /var/log/syslog does indeed find lines marking the startup of your system logger, if not then modify this line appropriately. The log file is sometimes /var/log/messages but presumably not in your case since you mention syslog.