Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I know that Ubuntu saves logs and rotates them overwriting older syslog.gz files.

Is it possible to recover overwritten logs? Perhaps with a specific software.

share|improve this question

Once a file is overwritten, it is lost. What you can do is to adapt the logrotation settings to hold more occurence of the logs you are interested to.

For log files generated by the syslogd process (I'm not speaking here of rsyslog or syslog-ng that I'm not using), the logrotation is done by a specific script installed together with the sysklogd package); By default the script is /etc/cron.daily/sysklogd. It use the command savelog to rotate all the logs created by syslog.

If you need to keep more archived logs, update the line looking like :

savelog -g adm -m 640 -u ${USER} -c 7 $LOG >/dev/null

The number after the -c is the number of cycle, so the number of log archived in this case will be 7. (one per day as the script is run daily).

share|improve this answer
Remark: for other log files, not generated by syslog, the process logrotate will manage the log rotation. – Benoit Mar 18 '14 at 10:38
Unless it is on a backup ;-) – Rinzwind Mar 18 '14 at 10:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.