How to archive syslog.log

[Elena Leontieva]

The CSO wants to archive the syslog.log(s) and keep them for 6 years.
This is not a log rotation question. I wonder if anybody has a procedure in place to rename the OLDsyslog.log after reboot and copy it to a different location for a special backup?

Any other ideas?

Thank you,
Elena.

[Pete Randall]

It should be simple enough to modify the rc script that creates OLDsyslog.log to copy the previous OLDsyslog.log to someplace where it could be stored more permanently.


Pete

[Pete Randall]

That would be /sbin/init.d/syslogd, by the way.

Pete

[James R. Ferguson]

Hi Elena:

This is simple. Create yourself a simple startup script that runs at run-level 3 --- well after the 'syslog' is moved to 'OLDsyslog'.

See the manpages for 'rc(1M)' for the details of the requirements for a startup script. You don't need a shutdown script for your purposes here.

Use '/sbin/init.d/template' as your script template.

Regards!

...JRF...

[Fedon Kadifeli]

The code can be something like this (real-life example):

I use an "inittasks" script
( /sbin/rc2.d/K001inittasks -> /sbin/init.d/inittasks )
( /sbin/rc3.d/S999inittasks -> /sbin/init.d/inittasks )
containg the following code:

...
# Rename files by appending "_date_time" stamp at the end of name.
rename_files () {
for f in $* ; do
/usr/contrib/bin/perl -e '$_ = shift;
($dev,$ino,$mode,$nlink,$uid,$gid,$rdev,$size,
$atime,$mtime,$ctime,$blksize,$blocks) = stat($_);
($sec,$min,$hour,$mday,$mon,$year) = localtime($mtime);
printf "%d%02d%02d_%02d%02d%02d\n",
$year+1900, $mon+1, $mday, $hour, $min, $sec;' $f | read ext
nf="${f%%_*}_$ext"
if [[ $f != $nf ]] ; then
print "$f -> $nf"
/bin/mv $f $nf || print "Error renaming $f"
fi
done
} # rename_files


...
rename_files /var/adm/syslog/OLD* /var/adm/OLD* /var/adm/cron/OLD*
...

[Fabien GUTIERREZ · Accepted solution]

if luckily you are using hpux 11.23 or higher you ll find already installed the tool you desired in the name of syslog-ng that allows you to consolidate within a single server all other servers syslog
it even avoids the loss of information occuring in multiple reboots oldsyslog getting the last syslog