0

I just setup a syslog forwarder but how do I forward older historical logs (like access_log)? Is it possible to replay log files so they'll send historical entries?

1
  • 2
    Why not just copy them over with scp/rsync/etc?
    – user143703
    Sep 22, 2015 at 22:13

2 Answers 2

1

The logger command has a '-f' option that allows you to specify a file name. '-n' lets you specify a remote server to send it to.

1
  • On my RHEL6 systems, logger does not support the -n flag. Sep 23, 2015 at 21:46
1

You can stream any text file to syslog via logger. This will follow whatever streaming method you've specified in syslog.conf, so make sure that your syslog.conf file lists the syslog server before you do this.

cat access_log | logger -t access_log_old

This will take access_log, read it line by line, and simply send the entire line to your syslog server with the tag of 'access_log_old'. Some caveats:

  • Each line will includes the date field at the beginning of access_log, which may not be what you want. You can use sed or awk to strip the date field from each line. Something like this would work:

    cat access_log | sed 's/MATCH//g' | logger -t access_log
    
  • Note that the event time in syslog will be the time that the event was received, not the event in the log.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .