delete record
 

I have a log file , that keep the record of system activities , as below , now the log is appending so that it becomes very large .

"
05/01/08 Normal userA
05/01/08 Normal userB
05/02/08 Alnormal userC
"
"
10/01/08 Normal userA
10/02/08 Normal userA
"


Now I would like to keep the log current , so if the date is over 60 days , then remove this row , like above , the first three row should be removed as 05/01/08 and 05/02/08 is over 60 days ( today is 10/08/08 ) , can advise how to do it ? thx

man logrotate

To expand, you can't easily remove the top/front of an open file being written to.
The usual solution is to use the logrotate utility as mentioned.
See /var/log
For a static/non-open file you can extract the top or bottom of a file using the head and tail cmds.

except logrotate , can give me the hits to write a script to do that ? thx

except logrotate ?? What do you mean?

edit:
if you want
then to get a copy of the last n lines of a file its

tail -n logfile > newlogfile

1st n lines

head -n logfile > newlogfile

These only take a copy, they don't remove the lines.

If you are prepared to do some programming, many langs eg Perl supply a truncate cmd.

thx reply ,

I tried the script in the link
http://forums.itrc.hp.com/service/fo...hreadId=213185

but I have some problem when run it in my distro .

I have read the man page of logrotate , I think the below part is function works for my case , but I am not too understand how it fit to my requirement , could advise do I need to write the script to make it ? thx

/var/log/news/news.crit {
monthly
rotate 2
olddir /var/log/news/old
missingok
postrotate
kill -HUP ?焝at /var/run/inn.pid??
endscript
nocompress
}

can advise what is the simpliest way to do it ? thx

On my system there's a file

/etc/cron.daily/logrotate

so it gets called daily. The logrotate files (like yours) are stored in

/etc/logrotate.d

you just need to look for the equiv on your distro. You'll need to do it as root.
Looks like you need to fix that kill cmd though... its unreadable here.