This is something rather special, but I bet you can help me out.

I'm working in an environment where many logfiles are generated and rotated, mainly from java-services runnning. As we are performing L&P tests on that environment, we often have the system generated more files, than are kept by logrotation. I now need a way to archive the rotated logs before they are deleted, to be able to have all logs generated during the test.

But I do not have the permissions to change the logrotation in any way, so I have to do it with bash and basic UNIX tools. Additionally, since it is Load-, and Performance tests the solution needs an absolutely small footprint regarding CPU and Memory usage.

First I considered using a hash like sha1sum to keep the hash and save all files that have altered, but generating and checking the hash seems somewhat time and CPU consuming.

This question is not necessarily about real code, but about a concept - although a code example would be very welcome.


You should use inoticoming. It is in the repos for Debian-family distros. If you are on another distro, you can probably compile from source.


inoticoming [ global-options ] directory actions*


Inoticoming is a daemon to watch a directory with Linux's inotify framework and trigger actions once files with specific names are placed in there.

You can use it as follows:

   inotcoming --initialsearch /directory/with/log/files --regexp \
   last_log_rotate_file10.txt mv {} /directory/to/store/log_rotate_files/`date +"%T"` \;

The action must be terminated by \;;

the option --initialsearch performs the following action as soon as the daemon starts;

the --regexp precedes a regular expression to be satisfied by the name of the file you wish to store elsewhere; here I assumed you know that the 10th log_rotate_file is the last one that will be kept by your system;

then the command follows, with {} identifying the file name which was matched by the --regexp option, and I have assumed you will want to move the file to a new directory, with a name reflecting the time of the operation. You can adjust this at will.

| improve this answer | |
  • Thank you for that one. But it's not quite a solution for me, because I'm only guest on the system (strange but it is like this). So no compiling and installing possible. Anyway, I'll ask for this tool to be installed. – Oliver Friedrich Jan 11 '14 at 8:35
  • @BeowulfOF You are too pessimistic. You can compile it and install it for yourself, on your own /home, and run it from there. I do not think there is any need for a system-wide install. – MariusMatutiae Jan 11 '14 at 8:41
  • Well, just because I could, doesn't mean I should. Nor that I'm allowed to. – Oliver Friedrich Jan 12 '14 at 9:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.