I am trying to determine the best method for maintaining the RME syslog so that it does not cause capacity or performance problems, but so that I can still look at the last 14 days worth of data.
I have tried using the Log Rotation (logrot) program, but it erases the syslog file after backing up and compressing it, so we do not have access to the 14 day's worth of data with the syslog analyzer -only new log entries after the program is run.
Are there any other methods that can be used? Am I missing something that should be obvious? I find it hard to believe that there isn't a way to just archive everything over 14 days old.
Any help or ideas would be appreciated.