If I understand, what you need,then simplest thing might be just to specify multiple saving locations in /etc/syslog.conf, example from syslog manpage.
#Kernel messages are first, stored in the kernel
file, critical messages and higher ones also go
to another host and to the console
As you can see, every kernel message is stored in /var/adm/kernel,and every critical kernel message will be sent to logserver on machine 'finlandia' and displayed on console as well. You will have to edit logrotate in /etc/logrotate.d/syslog, so logs will be rotated properly on your backup partition.
I believe this is better solution than backup with cron,because backup-logs are created everytime something is logged :-)
Anyway, if you will be interested in creating a backup log-server on remote machine, I recommend NSA RHEL Security Guide. Page 66. It helped us quite a lot when I was setting up a Rhel server with my classmates :-)
so you want to keep only one backup and not multiple backups for different points in time? than the easiest way to go should by using rsync in crontab to get your files synced every x minutes/hours/days to another folder.
If I understand, what you need,then simplest thing might be just to specify multiple saving locations in /etc/syslog.conf, example from syslog manpage.
#Kernel messages are first, stored in the kernel file, critical messages and higher ones also go to another host and to the console
As you can see, every kernel message is stored in /var/adm/kernel,and every critical kernel message will be sent to logserver on machine 'finlandia' and displayed on console as well. You will have to edit logrotate in /etc/logrotate.d/syslog, so logs will be rotated properly on your backup partition.
I believe this is better solution than backup with cron,because backup-logs are created everytime something is logged :-)
Anyway, if you will be interested in creating a backup log-server on remote machine, I recommend NSA RHEL Security Guide. Page 66. It helped us quite a lot when I was setting up a Rhel server with my classmates :-)
so you want to keep only one backup and not multiple backups for different points in time? than the easiest way to go should by using
rsync
incrontab
to get your files synced every x minutes/hours/days to another folder.