I believe logrotate
can do this with the copy
and postrotate
directives. I have never done this myself. Maybe here is the start of a logrotate.conf
stanza:
/var/log/mylog {
rotate 5
weekly
copy
postrotate
today=`date +"%b %e"
yesterday=`date +"%b %e" -d "-1 days"
tempfile=`mktemp`
grep "$today\|$yesterday" /var/log/mylog > $tempfile
mv $tempfile /var/log/mylog
endscript
}
This is not going to be ideal because of race conditions, I think. sed
might be a better choice. Note that the old log is going to have today and yesterday's date entries, so there will be duplicates. You could probably eliminate those with some additional scripting. Also, it would probably be better (and may be necessary) to put the lines of the postrotate
stanza in its own shell script.
This assumes that your logfiles use the common standard of specifying log dates with months and days like "Mar 29".
grep
ing for the date (grep -n "2016-03-28" <file> | awk -F ':' '{print $1}' | head -n 1
would do that). – Izzy♦ Mar 28 '16 at 19:47