Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I know that Ubuntu saves logs and rotates them overwriting older syslog.gz files.

Is it possible to recover overwritten logs? Perhaps with a specific software.

share|improve this question

1 Answer 1

Once a file is overwritten, it is lost. What you can do is to adapt the logrotation settings to hold more occurence of the logs you are interested to.

For log files generated by the syslogd process (I'm not speaking here of rsyslog or syslog-ng that I'm not using), the logrotation is done by a specific script installed together with the sysklogd package); By default the script is /etc/cron.daily/sysklogd. It use the command savelog to rotate all the logs created by syslog.

If you need to keep more archived logs, update the line looking like :

savelog -g adm -m 640 -u ${USER} -c 7 $LOG >/dev/null

The number after the -c is the number of cycle, so the number of log archived in this case will be 7. (one per day as the script is run daily).

share|improve this answer
    
Remark: for other log files, not generated by syslog, the process logrotate will manage the log rotation. –  Benoit Mar 18 at 10:38
1  
Unless it is on a backup ;-) –  Rinzwind Mar 18 at 10:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.