[Bash] Log wiping script

[lucid]

I wrote this little bash script awhile ago to wipe my logs on shutdown. However, there are a few log files in /var/log that I would rather not wipe clean.

Code: (bash) [Select]

#!/bin/sh

## Erase contents of all files in /var/log
find /var/log -type f -exec sh -c '> "{}"' \;

## Erase contents of bash history and shutdown
cat /dev/null > .bash_history
shutdown -h now

I don't really code in bash so I thought I would just ask. Can anyone think of a good way to achieve what I want with this but be able to avoid wiping select files?

[vezzy]

It's not considered good practice to completely erase everything in /var/log to the best of my knowledge. Some programs may rely (I know MySQL does) on the logs and configs/cache stored there to work properly, or you'll get a stream of errors.

Rather it's recommended you use the logrotate tool and write directives on exactly what to do in the /etc/logrotate.conf file.

As for the Bash history, that's a nice approach. I have one myself set as a daily cron job.

[techb]

I agree that removing log files isn't such a good idea. At least on startup. If your going to do it, do it with system shutdown and have the option to not remove it.

Saying that because the log files, especially with a kernel update or other things that may mess up the video card or something vital, will give a hint with something that may have gone wrong. If you could see the log files with a system boot and other things loading you can spot what might needed to be rolled-back.

Like  mentioned above, at the least do it at system shutdown and have an option to not delete anything.

[frog]

To answer your question lucid, bash does have all sorts of cool conditional functions. File test operators -> http://tldp.org/LDP/abs/html/fto.html

Code: (bash) [Select]

if [ -e /var/log/auth.log ]; then
  cat /dev/null > /var/log/auth.log
fi

Edit: Since we're on the topic of bash, I thought I would drop a couple gems.

$! = last pid launched - good for killing programs launched in the background(&)

Code: (bash) [Select]

tor & # launch it
kill $! # kill it

$? - status of last command. 

Code: (bash) [Select]

ifconfig eth0 hw ether IN:VA:LI:DM:AC:AD # this command WILL fail
 
if [ $? -gt 0 ]; then # if it fails, spit out a msg
  echo "MAC change failed."
fi

$$ - pid of the script currently running
$# - number of arguments passed to the script

Also, redirect operators are nice. Look into those for sure. Use them with stdin, stdout, stderr, and /dev/null to control where your data goes.

[lucid]

@techb - I do have it happen on shutdown. It only wipes files when I run the 'shutdown' command.

Thanks frog and vezzy for the ideas I'm sure I'll put them to good use.

[str0be]

You could do something like this where "~/.ignore" contains a set of newline separated patterns to filter out.


logempty.sh

Code: (bash) [Select]

#!/bin/sh


IGNORE=~/.ignore
START=/var/log/


empty () {
    OLDIFS="$IFS"
    IFS='
'
    for F in $@; do
        echo "EMPTY: $F"
        # uncomment when happy with .ignore patterns
        #cat /dev/null > "$F"
    done
    IFS="$OLDIFS"
}


empty "$(find "$START" -type f | grep -v -f "$IGNORE")"


.ignore

Code: [Select]

/cups/
/upstart/
.*\.gz$


Anything more complicated and you'd be reinventing logrotate, etc. Another option is to modify the file attributes of each of the logs you want skipped.

Code: [Select]

chattr +a /var/log/logfile.log


That would make the file usable only in append mode. Not even root would be able to mv/rm it nor modify what's already in it. Your original script would just pass by these files with an error. This could mess up programs that expect to do more than just append to their logs though.

[proxx]

I dont know if stealth is an issue, probably not on your own machine.
Just in case it might in some particular situation it might be an idea to first back up the log file and overwrite that before leaving.

[zoup]

I have something similar for my box. It's some hammer and amboss method but it works.

Code: [Select]

~/.bashrc
shred /home/iamtotallystupidbutilikeit/.bash_history ; rm /home/iamtotallystupidbutilikeit/.bash_history

# ignore sudo commands
HISTIGNORE=sudo*:*0-link*


[Naer]

Why don't you use ramfs? So you don't even need to worry about recovery things.