Tuesday, December 30, 2008

Syslog-ng log evacuation

#!/bin/sh

#calculate yesterday's date
YESTERDAY=`env TZ=EST29EDT date +%Y%m%d`

#find the logs associated with yesterday
LOGS=`/usr/bin/find /var/log/perhost -name "*.$YESTERDAY"`
PROXYLOGS=`/usr/bin/find /var/log/proxy -name "*.$YESTERDAY"`

#compress the logs
/usr/bin/gzip $LOGS
/usr/bin/gzip $PROXYLOGS

#now select the logs.gz
GZLOGS=`/usr/bin/find /var/log/perhost -name "*.$YESTERDAY.gz"`
PROXYGZ=`/usr/bin/find /var/log/proxy -name "*.$YESTERDAY.gz"`

#change ownership of the files so the remote sawmill process can read them
/usr/bin/chmod 644 /var/log/perhost/*


#cp the files to sawmill ~logevac
/usr/bin/cp $GZLOGS /nfsserver/servers/sawmill/evacuated-logs
/usr/bin/cp $PROXYGZ /nfsserver/servers/sawmill/proxy-logs-to-be-processed
#
/usr/bin/chmod 644 /nfsserver/servers/sawmill/evacuated-logs/*
/usr/bin/chown 55555:55555 /nfsserver/servers/sawmill/evacuated-logs/*

# remove the local syslog-ng server files after 7 days
oldlogs=`/usr/bin/find /var/log -mtime +7`
/usr/bin/rm $oldlogs

# clear out the logfiles older than 21 days
/usr/bin/find /hjfnfs/servers/sawmill/evacuated-logs -name "*log*.gz" -mtime +21 -exec /usr/bin/rm -f {} \;

No comments: