How to archive a dayly syslog flat file

hlichiere · ‎10-27-2009

Hi all,

I have recently installed a new platefrom LMS 3.2 on solaris 10. I would like to create a syslog flat file dayly from the syslog_info file over one year. I think of using the log rotation tool to have a dayly file. Remark, the file name must be the current date. Is-it the better solution ?? Have you an other idea to do it. Perhaps using the backup syslog from RME. I have tested this solution, but i can't choose my directory and the file obtained is only to a CSV file. Who already had this case and how that was solved.

Thx a lot for your ideas. Rgds. Herve

Joe Clarke · ‎10-27-2009

You could use logadm to do this. Currently, logrot only rotates to numbered archives. However, if you wanted to archive the files with the date, logadm can do this. For example, something like the following in /etc/logadm.conf would work:

/var/log/syslog_info -c -C 10 -p 1y -t "/var/log/backups/$basename.%Y%m%d"

The -c option is critical. Without this, SyslogCollector and syslogd would need to be restarted before log processing in RME would continue.

hlichiere · ‎10-27-2009

Hi,

Thanks for your help.

To understand :

I changed the location of the syslog_info file to another directory (/datapool/archive/xxxx). To create a dayly file from syslog_info i must to add this line :

/datapool/archive/syslog_info -c -C 10 -p 1y -t "/datapool/archive/xxx/$basename.%Y%m%d"

Could you give me more precision about the syntax ?? How to configure a dayly process ?? Is it the syslog_info is purge or just forwarded to a new file ?

Rgds

Joe Clarke · ‎10-27-2009

Actually, my example will configure a yearly rotation. If you want daily, change -p 1y to -p 1d. The rest of your example should work.

When logadm runs, it will copy the existing contents of syslog_info to the archive file, then zero out syslog_info.