Using Oracle Linux 8, I have a /usr/local/caplogs/logs folder which has logs from my services written to it constantly.
I have S3 storage, which I have attached to /usr/local/caplogs/logarchive using S3-FUSE which works superb, I then take anything that is 28 days old, move it to the archive folder which pushes to the cloud host.
What I am trying to achieve is to remove the logarchive folder and just map it to the logs directory. The problem there is I need to retain local 28 days of logs as I need to graph and output reports from the local disk which is in subnet with my graphing box. I can write to the cloud, but I can't read from it, it gets read from a specific source as we limit the API to a specific external host and username/keypair. I 'could' cut holes in this, but there are some security concerns with doing so. I could also 'copy' rather than move, but the cost of local storage vs cloud storage is why we have gone down this route and I need to keep ~3 years of storage in the cloud, which would be close to 300TB minimum local space which we would need to pay for in physical and cloud.
Essentially I would like;
/usr/local/caplogs/logs -- <28days local on /dev/sda1
/usr/local/caplogs/logs -- 29+ days remote on /s3-amazon etc
Is there any magical way to achieve this. I've looked into a few options but nothing suggests to do what I would like to achieve.
Thanks in advance!