Logrotate - leave file with some it's content

Question

I'm looking for a tool or script which log rotates a folder or individual log files, but leaves some lines in the logs, for example, it cuts all lines older than 2 days and writes them into another file.

are there any scripts, tools or daemons which can do this? (I'm working with raspian)

Answer 1

I believe logrotate can do this with the copy and postrotate directives. I have never done this myself. Maybe here is the start of a logrotate.conf stanza:

/var/log/mylog { 
    rotate 5
    weekly
    copy
    postrotate
        today=`date +"%b %e"
        yesterday=`date +"%b %e" -d "-1 days"
        tempfile=`mktemp`
        grep "$today\|$yesterday" /var/log/mylog > $tempfile
        mv $tempfile /var/log/mylog
    endscript
} 

This is not going to be ideal because of race conditions, I think. sed might be a better choice. Note that the old log is going to have today and yesterday's date entries, so there will be duplicates. You could probably eliminate those with some additional scripting. Also, it would probably be better (and may be necessary) to put the lines of the postrotate stanza in its own shell script.

This assumes that your logfiles use the common standard of specifying log dates with months and days like "Mar 29".