Time travelling and log files

Question

When testing changes to a legacy codebase on a development system, my preferred method of testing is to set the system clock to a date in the past, eg date -s '-7 days', I then playback some operations, check output and log files, and advance the date 1 day, then playback more operations, check output and logs, advance 1 day, and basically repeat this for as long as necessary.

After the initial journey into the past, but before playing back operations, I run this command to truncate log files that have modified dates in the future:

logs=$(find /var/log -type f -mtime -0); for log in $logs; do cat /dev/null > $log; done

This empties the log files, however what I'd really like is a way to delete "future entries" in files, under /var/log/ and it's subdirs (apache/mysql/...) that occurred after the server's current date.

Are there any utils/tools that will help to delete log entries from the future, rather than completely truncating files as I do at the moment.

I'm using Debian stable.

Answer 1

You can use logrorate -f if your system uses logrorate. This should rotate (i.e. empty) all the logs immediatelly. See logrotate(8).

Edit: In fact your system does not need to use logrotate permanently, you can have prepared configuration file just for this one rotation and run it only after pushing the time backwards. Logrorate has also benefit of not losing all the actual logs, they are only gzipped and the oldest gzips are deleted.

Answer 2

Take a snapshot of the log directory, one way or another.

Your scenario sounds like it calls for running the tests in a virtual machine. Take a snapshot of the VM, run the tests, and once you have the test results, discard the VM state and restore the snapshot.

If you want to run the tests without making a VM snapshot, you could take a backup of the log directory, and after the tests, restore the backup and restart the syslog daemon. Or you could temporarily mount a tmpfs filesystem on /var/log, restart syslogd, run the tests, unmount /var/log, restart syslogd.