I just setup a syslog forwarder but how do I forward older historical logs (like access_log)? Is it possible to replay log files so they'll send historical entries?
2 Answers
The logger command has a '-f' option that allows you to specify a file name. '-n' lets you specify a remote server to send it to.
You can stream any text file to syslog via logger
. This will follow whatever streaming method you've specified in syslog.conf
, so make sure that your syslog.conf file lists the syslog server before you do this.
cat access_log | logger -t access_log_old
This will take access_log, read it line by line, and simply send the entire line to your syslog server with the tag of 'access_log_old'. Some caveats:
Each line will includes the date field at the beginning of access_log, which may not be what you want. You can use
sed
orawk
to strip the date field from each line. Something like this would work:cat access_log | sed 's/MATCH//g' | logger -t access_log
Note that the event time in syslog will be the time that the event was received, not the event in the log.