Create a tar.gz file (gzipped tar archive) containing Linux distribution system logs for use in a subsequent investigation. An additional subdirectory is created containing information about the Linux distribution release and the resident hardware.

getlogs.sh

MYSELF=`basename $0`
ARGC=$#
#--- Validate command line
if [ $ARGC -ne 1 ] || [ -z $1  ]; then
	echo
	echo -e "\tUsage:\t"$MYSELF"\t{FILENAME.tar.gz}"
	echo
	exit 86
fi
TAROUTFILE=${1}.tar.gz
#--- Initialize/re-initialize temporary directory
TMPDIR=/tmp/getlogs
ADDITIONAL=/tmp/getlogs/ADDITIONAL
if [ -d $TMPDIR ]; then
	sudo rm -rf $TMPDIR/*
	if [ $? -ne 0 ]; then
		echo 
		echo -e "\t*** $MYSELF: rm -rf $TMPDIR/* failed"
		echo
		exit 86
	fi
	echo "$MYSELF: Cleaned out $TMPDIR"
else 
	mkdir $TMPDIR
	if [ $? -ne 0 ]; then
		echo 
		echo -e "\t*** $MYSELF: mkdir $TMPDIR failed"
		echo
		exit 86
	fi
	echo "$MYSELF: Created $TMPDIR"
	mkdir $ADDITIONAL
	if [ $? -ne 0 ]; then
		echo 
		echo -e "\t*** $MYSELF: mkdir $ADDITIONAL failed"
		echo
		exit 86
	fi
	echo "$MYSELF: Created $TMPDIR"
fi
#--- Copy logs to temporary directory
sudo cp -RL --no-preserve=ownership /var/log/*	$TMPDIR
echo "$MYSELF: Copied system logs (/var/log/*) to $TMPDIR"
#--- Create additional logs in temporary directory
uname -a > $ADDITIONAL/uname.log
lsb_release -a > $ADDITIONAL/lsb_release.log
lsmod > $ADDITIONAL/lsmod.log
ps ax > $ADDITIONAL/psax.log
sudo lshw > $ADDITIONAL/lshw.log
sudo lsusb -v > $ADDITIONAL/lsusb.log
sudo lspci -vv > $ADDITIONAL/lspci.log
echo "$MYSELF: Created additional logs in $ADDITIONAL"
#--- Create output tar file in format expressed by $TAROUTFILE file extension
sudo tar cfz $TAROUTFILE $TMPDIR/*
if [ $? -ne 0 ]; then
	echo 
	echo -e "\t*** $MYSELF: tar cvf $TAROUTFILE $TMPDIR failed"
	echo
	exit 86
fi
#--- Change owner of $TAROUTFILE from root to $USER
sudo chown $USER $TAROUTFILE
if [ $? -ne 0 ]; then
	echo 
	echo -e "\t*** $MYSELF: chown $USER $TAROUTFILE failed"
	echo
	exit 86
fi
#--- Remove temporary directory
sudo rm -rf $TMPDIR
if [ $? -ne 0 ]; then
	echo 
	echo -e "\t*** $MYSELF: rm -rf $TMPDIR failed"
	echo
	exit 86
fi
#--- Bye bye
echo "$MYSELF: Success, output: $TAROUTFILE"
exit 0