eels_log_archive(1Meels)

eels_log_archive -- archive and optionally delete records from an EELS database

Synopsis

eels_log_archive -a archive_name [-b time_spec] [-d database] [-e time_spec] [-p] [-q SQL_Query] [-s]

Description

Use eels_log_archive to archive selected records from the EELS database, and optionally delete the selected records from the database. The records are stored in a file in compressed format. An archive can be restored to a temporary EELS database using eels_log_restore(1Meels).

The records are stored in the archives in compressed ASCII format, using the UNIX compress(1) command. The first line of the archive provides information on the order of fields in the database. The format string is a vertical bar ``|'' separated list of database fields, that specify the order of fields in the archive. This information is used when restoring the archive to make sure that the data ends up in the correct field of the database. The remainder of the archive file contains a record per line with each field separated by a vertical bar ``|''.

eels_log_archive is a perl(1) script that uses eels_db_query(1Meels) to do most of its work. Either you must specify an SQL query when you call eels_log_archive or a default of ``select * from events'' is used which is then passed to eels_db_query to select records from the database. The eels_db_query command outputs records using a vertical bar ``|'' to delimit each field, so the output of eels_db_query can be directly written to the archive file. The data is not actually written directly to the file. It is first compressed by piping the output through the compress command.

The eels_log_archive command prints status information when archiving which includes the number of records to archive, and a percentage of the total records that have been archived. This information updates continually to give the operator an indication of how the archive is proceeding.

Options

-a archive_name: The name of the archive file. A ``.Z'' is automatically appended to the archive_name.
-b time_spec: Only archive records at or before this time. The format of time_spec is: DD-month YYYY HH:MM:SS where month is ``Jan'', ``Feb'', ``Mar'', and so on. You can also use ``today'', ``yesterday'', ``tomorrow'' in place of the DD-Month specification.
-d database: The name of the database to archive records from. The default is ``defaultdb''.
-e time_spec: Only archive records at or before this time. The time_spec format is the same as for the -b option.
-p: Purge records from database after they are archived. The default is ``do not purge''.
-q SQL_Query: The SQL query that selects the records to be archived. The default is ``select * from events''.
-s: Run this command in silent mode, that is, do not output any status messages to the screen.

Examples

eels_log_archive -p -a /etc/eels/archives/eels_archive_03161998 \
-q "select * from events where LogSystemSource = 'syslog'"

The above example archives all records that originated from ``syslog'' to an archive file named /etc/eels/archives/eels_archive_03161998.

References

compress(1), eels_config(4eels), eels_db_query(1Meels), eels_log_restore(1Meels)