topic Re: Syslog purging in Operating System - HP-UX

Syslog purging

Jeeshan — Mon, 04 May 2009 04:33:54 GMT

Hi all

My syslog file is too large. I want to copy the lines by date wise like "Apr 1 to May 4".

Please suggest me.

Re: Syslog purging

Dennis Handly — Mon, 04 May 2009 05:57:56 GMT

You could do it manually in vi(1).
Or you could use sed:
sed -e '/Apr 1/,$p/' syslog.log > syslog.latest

You'll need to find the exact format for Apr 1 from the syslog file.

Re: Syslog purging

Suraj K Sankari — Mon, 04 May 2009 07:23:20 GMT

Hi,
just copy the file into other name
#cd /var/adm/syslog
#cp syslog.log syslog.old
vi syslog.old
go to the desire line
press Esc :,$d
it will remove all below lines from the cursor position.

Suraj

Re: Syslog purging

James R. Ferguson — Mon, 04 May 2009 10:08:31 GMT

HI:

> I want to copy the lines by date wise like "Apr 1 to May 4".

This suggests that these are the lines you actually want to _preserve_ in your 'syslog'.

You could simply 'vi' the current '/var/adm/syslog/syslog.log' deleting everything before this range begins.

You could, as Dennis suggested, use something like 'sed' to match and print lines in that region to a new file.

If you chose to redirect output to a new file, like 'syslog.latest' or 'syslog.new' and then wish to _replace_ the contents of the "real" syslog file with it:

Do _NOT_ use 'mv' to replace the old file with the new file. Instead, use 'cp' to keep the current file associated with the current 'syslogd' process. If you erroneously 'mv' a new file over the old one, you will find that further logging will not occur until you restart the 'syslogd' daemon.

If you examine the "start" action of '/sbin/init.d/syslogd' you will see that a restart of the 'syslogd' daemon is made following a 'mv' [rename] of the current 'syslog' to 'OLDsyslog'.

Regards!

...JRF...

Re: Syslog purging

Jeeshan — Mon, 04 May 2009 10:27:20 GMT

thnx all

Re: Syslog purging

Dennis Handly — Tue, 05 May 2009 01:36:22 GMT

>sed -e '/Apr 1/,$p/' syslog.log > syslog.latest
>ME: You'll need to find the exact format for Apr 1 from the syslog file.

Oops, slight problem, that should have a -n!

In mine, there is one space after the month and for one digit dates, there is an extra space.

I assume you don't have to worry about no syslog entries for Apr 1? ;-)

For partial months, you could use:
sed -n -e '/^Apr /,$p/' syslog.log

This picks the first entry for April, even if you rebooted on Apr 15.

Re: Syslog purging

Dennis Handly — Tue, 05 May 2009 01:39:40 GMT

Oops another typo: sed -n -e '/^Apr /,$p' syslog.log

Re: Syslog purging

Jeeshan — Tue, 05 May 2009 03:32:49 GMT

thnx Denis