I want to manipulate logs. So far, for me the best way to clear system logs is:
truncate -s 0 /var/log/*log
I'm searching for the best ways to:
1 - Do the above periodically. I have already try logrotate
, but i couldn't set it up to make excactly what i want, meaning keep only the original log file and truncate it periodically without deleting it.
- Updated:
According to northern-bradley answer here the solution seems to be in using lastaction/endscript
option into logrotate config file. So, it works perfectly by using this settings:
/var/log/*log{
rotate 0
size 0
hourly
nocreate
maxage 0
missingok
nocompress
ifempty
copytruncate
lastaction
rm -rf /var/log/*log.1
endscript
}
The copytruncate
option copy the logs into new log files ignoring rotate 0
and nocreate
, then truncates the original logs. After all log files have been rotated, rm
into lastaction/endscript
section deletes all new log files created by copytruncate
. At the end we have only the original files cleared.
2 - Clear last 'n' entries
3 - Block/Unblock new entries, something like freeze/unfreeze. For this i am thinking to use ln -s /dev/null /var/log/*log
, but i don't know if i can restore this easly without needing any script. Or maybe a backup/restore state technick could help.
Is there any other way that could help me to do all the above (2 and 3)?