Syslog purging

[Jeeshan]

Hi all

My syslog file is too large. I want to copy the lines by date wise like "Apr 1 to May 4".

Please suggest me.

[Dennis Handly · Accepted solution]

You could do it manually in vi(1).
Or you could use sed:
sed -e '/Apr 1/,$p/' syslog.log > syslog.latest

You'll need to find the exact format for Apr 1 from the syslog file.

[Suraj K Sankari]

Hi,
just copy the file into other name
#cd /var/adm/syslog
#cp syslog.log syslog.old
vi syslog.old
go to the desire line
press Esc :,$d
it will remove all below lines from the cursor position.

Suraj

[James R. Ferguson]

HI:

> I want to copy the lines by date wise like "Apr 1 to May 4".

This suggests that these are the lines you actually want to _preserve_ in your 'syslog'.

You could simply 'vi' the current '/var/adm/syslog/syslog.log' deleting everything before this range begins.

You could, as Dennis suggested, use something like 'sed' to match and print lines in that region to a new file.

If you chose to redirect output to a new file, like 'syslog.latest' or 'syslog.new' and then wish to _replace_ the contents of the "real" syslog file with it:

Do _NOT_ use 'mv' to replace the old file with the new file. Instead, use 'cp' to keep the current file associated with the current 'syslogd' process. If you erroneously 'mv' a new file over the old one, you will find that further logging will not occur until you restart the 'syslogd' daemon.

If you examine the "start" action of '/sbin/init.d/syslogd' you will see that a restart of the 'syslogd' daemon is made following a 'mv' [rename] of the current 'syslog' to 'OLDsyslog'.

Regards!

...JRF...

[Jeeshan]

thnx all

[Dennis Handly]

>sed -e '/Apr 1/,$p/' syslog.log > syslog.latest
>ME: You'll need to find the exact format for Apr 1 from the syslog file.

Oops, slight problem, that should have a -n!

In mine, there is one space after the month and for one digit dates, there is an extra space.

I assume you don't have to worry about no syslog entries for Apr 1? ;-)

For partial months, you could use:
sed -n -e '/^Apr /,$p/' syslog.log

This picks the first entry for April, even if you rebooted on Apr 15.

[Dennis Handly]

Oops another typo: sed -n -e '/^Apr /,$p' syslog.log

[Jeeshan]

thnx Denis