Home / ubuntu / Questions / 896045
In Process
ioaniatr
Asked: 2017-03-24 05:39:16 +0800 CST

Best ways to manipulate system logs

  • 772

I want to manipulate logs. So far, for me the best way to clear system logs is:

truncate -s 0 /var/log/*log

I'm searching for the best ways to:

1 - Do the above periodically. I have already try logrotate, but i couldn't set it up to make excactly what i want, meaning keep only the original log file and truncate it periodically without deleting it.

- Updated:

According to northern-bradley answer here the solution seems to be in using lastaction/endscript option into logrotate config file. So, it works perfectly by using this settings:

/var/log/*log{
       rotate 0
       size 0 
       hourly
       nocreate
       maxage 0
       missingok
       nocompress
       ifempty
       copytruncate
       lastaction
             rm -rf /var/log/*log.1
       endscript
}

The copytruncate option copy the logs into new log files ignoring rotate 0 and nocreate, then truncates the original logs. After all log files have been rotated, rm into lastaction/endscript section deletes all new log files created by copytruncate. At the end we have only the original files cleared.

2 - Clear last 'n' entries

3 - Block/Unblock new entries, something like freeze/unfreeze. For this i am thinking to use ln -s /dev/null /var/log/*log, but i don't know if i can restore this easly without needing any script. Or maybe a backup/restore state technick could help.

Is there any other way that could help me to do all the above (2 and 3)?

bash

1 Answers

  1. Logrotate is specifically designed to handle such tasks and it does it job pretty well. I suggest you use it.

    Now, lets look (and if necessary - fix) your logrotate file, by using the fine manual pages provided by the good guys from Ubuntu (link).

    Your version:

    # File: /etc/logrotate.d/.test
/var/log/*log{
   size 0 
   hourly
   nocreate
   copytruncate
   rotate 0
}

    I suggest you use the below:

    # File: /etc/logrotate.d/.test
/var/log/*.log{
# the rotate option sets how many times the log files are rotated before being removed. Setting it to 0 means - delete right away (you'll only have the original)
   rotate 0
# the size option sets what size should a file reach before being rotated - I'm setting it to 10MB, but you can change it as it pleases you
   size 10M
# The size option will prevail this option. The daemon will run hourly, but won't rotate the log file until it reaches 10 MB
   hourly
# this option fits your requirement not to create new log files
   nocreate
# delete rotated log files older than 0 days
   maxage 0
# truncate the original file rather creating new one
   nocopytruncate
}
    • 2