syslog for 60 days

[Ravi_8]

Hi, all

when i looked into OLDsyslog.log file of all systems it has the logs till last boot and syslog.log from the last boot. Now my question is how to keep the logs for 60 days irrespective of boots

Thank u all

[RAC_1]

Everytime the system is started the syslog is move to OLDsyslog.log and new one started.

I just looked at syslogd in /sbin/init.d directory.

That says no changes in this file. The other way I can think of is putting a script in sbin/init.d and links in respective rc levels in such a way that it checks for syslog.log file then renames it. this way we can control syslog.log file moved. and at the same time syslogd daemon will be able to keep two files. OLDsyslog.d and syslog.log.

No idea on how I would start the script before syslogd starts.

[RAC_1]

Everytime the system is started the syslog is move to OLDsyslog.log and new one started.

I just looked at syslogd in /sbin/init.d directory.

That says no changes in this file. The other way I can think of is putting a script in sbin/init.d and links in respective rc levels in such a way that it checks for syslog.log file then renames it. this way we can control syslog.log file moved. and at the same time syslogd daemon will be able to keep two files. OLDsyslog.d and syslog.log.

No idea on how I would start the script before syslogd starts.

[RAC_1]

sorry for three replies.

Problem with accessing internet.

[Ralph Grothe]

Why don't you roll your own log rotation scheme for /var/adm/syslog/syslog.log?

I think all that should be required is to send syslogd a SIGHUP to restart system logging.
Thus I would think you could do something like


gzip -c /var/adm/syslog/syslog.log > /var/adm/syslog/syslog_till_$(date +%Y%m%d).gz
> /var/adm/syslog/syslog.log && kill -s 1 $(cat /var/run/syslog.pid)

put something similar (better more eleborate) in a script and have it run through cron at your rotation intervall

[Ralph Grothe]

Sorry,

I was deviating, and didn't answer your question.

I think (though this may be not good practice) you will have to modify this line here

# grep mv /sbin/init.d/syslogd
mv /var/adm/syslog/syslog.log /var/adm/syslog/OLDsyslog.
log


And do the move instead through your own rotation scheme at wanted intervalls.

[Rajeev Shukla]

Hi,
true when ever the system is booted the syslog gets coppied to Oldsyslog and a new syslog file starts.
To save these files write a housekeeping script which copies the syslog everyday to a file with date stamp.
Something like syslog25MonDec.
and empty the syslog file. Keep files only for 60 days and delete rest.
You you need more info on how to write that script let me know.

Cheers
Rajeev

[Leif Halvarsson_2]

Hi
I think this is possible.

In the file /sbin/init.d/syslog is a line:
mv /var/adm/syslog/syslog.log /var/adm/syslog/OLDsyslog.log
Comment out this line.

Write a cron script that copy the syslog.log file to OLDsyslog.log and reset syslog.log

cp /var/adm/syslog/syslog.log /var/adm/syslog/OLDsyslog.log
>/var/adm/syslog/syslog.log

Run this script once evry second month.

0 0 1 1,3,5,7,9,11 * /

[Ravi_8]

Hi, rajeev

I can't do moving files manually on over 100 HP machines that we have. I need automate the process

[Rajeev Shukla]

Thats why i am saying Ravi. Write a script, put it in the cron and forget it. It will copy the cron to another file at midnight, trim the original syslog to 0 and then search for files older that 60 days and delete them its so simple.
Use cron dont do things manually


Rajeev

[Ravi_8]

Hi, Leif and rajeev

commented that line in syslogd file under /sbin/init.d and made a crontab entry.
but after reboot syslogd daemon is not starting

[Marco Santerre]

I would probably go the cron route myself. But the one thing to keep in mind is to shut down the syslogd daemon first before you move your files around. The reason for this is that the syslogd will create the syslog.log file on its own and attach itself to it, so if you copy the syslog.log without stopping the daemon first, the daemon will be all screwed trying to write to your OLDsyslog.log after you've copied it. Now the bad part about this, is for the time you will stop your daemon, you won't record anything into your syslog.

[Rajeev Shukla · Accepted solution]

Ravi There is no need of commenting the line in /sbin/init.d/syslogd
and neither do move the file /var/adm/syslog/syslog.log. always copy this file to /var/adm/syslog/syslog.log.DATE through a some script called by cron and then trim the syslog.log to zero by just doing > syslog.log.

With this method you have syslog of each day saved and you dont need to bring down the syslogd demon also.

Cheers
Rajeev

[Leif Halvarsson_2]

Hi,
Sorry, you actually has to comment out all the following lines.

if [ -f /var/adm/syslog/syslog.log ]; then
# mv /var/adm/syslog/syslog.log /var/adm/syslog/OLDsyslog.log
# mask=`umask`
# umask 022
# > /var/adm/syslog/syslog.log
# umask $mask
# fi

I tested this on one of our systems, the syslogd starts after rebooting and the boot messages are appended to the syslog.log file (no new file is created).

[Leif Halvarsson_2]

Sorry again,
I have problems with cut and paste. The line

if [ -f /var/adm/syslog/syslog.log ]; then

should of course be commented out too.

[Ravi_8]

Hi,
by adding few lines in syslogd file solved my problem. here is the portion of this file which i modified

start')
if [ -x /usr/sbin/syslogd -a -f /etc/syslog.conf ]; then
if[ -f /var/adm/syslog/OLDsyslog.log]
then
cat /var/adm/syslog/OLDsyslog.log >> /var/adm/syslog/syslog
then
if [ -f /var/adm/syslog/syslog.log ]; then
mv /var/adm/syslog/syslog.log /var/adm/syslog/OLDsyslog.log
mask=`umask`
umask 022
>/var/adm/syslog/syslog.log
umask $mask

Rajeev and Leif thanx a lot

[Q4you]

If you are still looking for a solution to preserve the syslog file aftr every reboot , add this rotation login in syslogd ->
if [ -x /usr/sbin/syslogd -a -f /etc/syslog.conf ]; then
if [ -f /var/adm/syslog/OLD5syslog.log ]; then
mv /var/adm/syslog/OLD5syslog.log /var/adm/syslog/OLD6syslog.log
fi
if [ -f /var/adm/syslog/OLD4syslog.log ]; then
mv /var/adm/syslog/OLD4syslog.log /var/adm/syslog/OLD5syslog.log
fi
if [ -f /var/adm/syslog/OLD3syslog.log ]; then
mv /var/adm/syslog/OLD3syslog.log /var/adm/syslog/OLD4syslog.log
fi
if [ -f /var/adm/syslog/OLD2syslog.log ]; then
mv /var/adm/syslog/OLD2syslog.log /var/adm/syslog/OLD3syslog.log
fi
if [ -f /var/adm/syslog/OLD1syslog.log ]; then
mv /var/adm/syslog/OLD1syslog.log /var/adm/syslog/OLD2syslog.log
fi
if [ -f /var/adm/syslog/syslog.log ]; then
mv /var/adm/syslog/syslog.log /var/adm/syslog/OLD1syslog.log

[Q4you]

If you are still looking for a solution to preserve the syslog file after every reboot(upto 6 reboots) , add this rotation logic in syslogd ->

if [ -x /usr/sbin/syslogd -a -f /etc/syslog.conf ]; then
if [ -f /var/adm/syslog/OLD5syslog.log ]; then
mv /var/adm/syslog/OLD5syslog.log /var/adm/syslog/OLD6syslog.log
fi
if [ -f /var/adm/syslog/OLD4syslog.log ]; then
mv /var/adm/syslog/OLD4syslog.log /var/adm/syslog/OLD5syslog.log
fi
if [ -f /var/adm/syslog/OLD3syslog.log ]; then
mv /var/adm/syslog/OLD3syslog.log /var/adm/syslog/OLD4syslog.log
fi
if [ -f /var/adm/syslog/OLD2syslog.log ]; then
mv /var/adm/syslog/OLD2syslog.log /var/adm/syslog/OLD3syslog.log
fi
if [ -f /var/adm/syslog/OLD1syslog.log ]; then
mv /var/adm/syslog/OLD1syslog.log /var/adm/syslog/OLD2syslog.log
fi
if [ -f /var/adm/syslog/syslog.log ]; then
mv /var/adm/syslog/syslog.log /var/adm/syslog/OLD1syslog.log