1

Is there a utility that will show you a difference in a directory of log files at one point of time and at the current moment?

Current a method in debugging applications is to remove all of the logs before the problem occurs and then reproduce the error, save the new ones. However, is there a utility that will help me do this, and to avoid removing the existing log files?

I'm looking for a Linux-based utility. I also only care about the new content, not any of the old logs.

2
  • The only way of doing this would be to take snapshots of the logs at different time points. You could just make a cronjob that backs up the logs at the end of each day, then you could go back and compare.
    – terdon
    Apr 16, 2013 at 18:13
  • I'm ok with a tool being used to set the previous point in time.
    – monksy
    Apr 16, 2013 at 18:16

2 Answers 2

2

Well, if a simple cron job will do, you could set up something like this:

  1. As root run crontab -e and add this line to your crontabs:

    00 22 * * * tar czf /log_backups/`date +%m%d%Y`.tgz /var/log/ 
    

    This will run every night at 22:00 and create an archive named .tgz in the directory /log_backups/. So, if today is April 16, 2013, it will create an archive called 04162013.tgz

  2. If you want to compare today's apache logs to those from yesterday, just extract the relevant tar ball and compare the files (obviously, you will need to have backup yesterday's logs):

    tar xzf /log_backups/03162013.tgz -C /tmp/
    diff /var/log/apache2/error.log /tmp/var/log/apache2/error.log
    

You can make this much more sophisticated by extracting only the relevant file from the archive, or choosing which files to add to the archive etc etc.

1

Why not use logrotate (man page)?

Seems like it's exactly what you're looking for:

logrotate is designed to ease administration of systems that generate large numbers of log files. It allows automatic rotation, compression, removal, and mailing of log files. Each log file may be handled daily, weekly, monthly, or when it grows too large.

Normally, logrotate is run as a daily cron job. It will not modify a log multiple times in one day unless the criterion for that log is based on the log's size and logrotate is being run multiple times each day, or unless the -f or --force option is used.

Any number of config files may be given on the command line. Later config files may override the options given in earlier files, so the order in which the logrotate config files are listed is important. Normally, a single config file which includes any other config files which are needed should be used. See below for more information on how to use the include directive to accomplish this. If a directory is given on the command line, every file in that directory is used as a config file.

If no command line arguments are given, logrotate will print version and copyright information, along with a short usage summary. If any errors occur while rotating logs, logrotate will exit with non-zero status.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .