0

Is there a command to view logrotated logs as a continuous stream with proper ordering?

I need to view all entries in syslog in historical order starting from the oldest entry available. So far I was inspecting logs one by one manually.

-rw-r-----   1 syslog    adm             140368 Jun 12 09:41 syslog
-rw-r-----   1 syslog    adm              45498 Jun 12 06:25 syslog.1
-rw-r-----   1 syslog    adm               1874 Jun 11 06:25 syslog.2.gz
-rw-r-----   1 syslog    adm               1758 Jun 10 06:25 syslog.3.gz
-rw-r-----   1 syslog    adm               1615 Jun  9 06:25 syslog.4.gz
-rw-r-----   1 syslog    adm              28494 Jun  8 06:25 syslog.5.gz
-rw-r-----   1 syslog    adm              92359 Jun  7 06:53 syslog.6.gz
-rw-r-----   1 syslog    adm              13849 Jun  6 09:21 syslog.7.gz
  • journalctl doesn't work in your scenario ? – Marged Jun 17 at 21:10
  • @Marged are you sure that journalctl includes all info from syslog for postmortem analysis? I've got an impression that syslog is independent of systemd/journalctl and it is written even if those both are killed, for example with out of memory. – Anatoli Babenia Jul 17 at 9:11
  • 1
    I wouldn't bet money on it ;-) – Marged Jul 17 at 11:49
1

If all the files are there without any extension then yes you can execute the cat command with * (cat ) it will display the content of each and every files underneath this directory, but here in your output it has the zip files (.gz) too, so you need to execute 2 commands rather than single command...

  1. cat syslog syslog.1
  2. zcat *.gz

Hope this will helps.

  • This doesn't guarantee the proper ordering, right? – Anatoli Babenia Jul 17 at 9:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.