logrotate 是一个日志切分工具。一般要结合cron一起工作。
logstash 是日志集中管理工具,但输出到文件时不能自动按大小切分(目前只能按日期)
比如系统的messege/cron/secure 都是cron + logrotate(一周跑一次)
[[email protected] logstash_conf]# ls /var/log/mess* -1
/var/log/messages
/var/log/messages-20150208
/var/log/messages-20150215
/var/log/messages-20150222
/var/log/messages-20150301
[[email protected] logstash_conf]# tree -finh /etc/logrotate*
/etc/logrotate.conf
/etc/logrotate.d
[ 135] /etc/logrotate.d/iptraf
[ 115] /etc/logrotate.d/samba
[ 210] /etc/logrotate.d/syslog
........................
2. 默认配置:
[[email protected] logstash_conf]# cat /etc/logrotate.conf |grep -v \#
weekly
rotate 4
create
dateext
include /etc/logrotate.d
/var/log/wtmp {
monthly
create 0664 root utmp
minsize 1M
rotate 1
}
/var/log/btmp {
missingok
monthly
create 0600 root utmp
rotate 1
}
3. 自定义配置:
在 /etc/logrotate.d/下面 。比如:/etc/logrotate.d/syslog
[[email protected] logstash_conf]# cat /etc/logrotate.d/syslog
/var/log/cron
/var/log/maillog
/var/log/messages
/var/log/secure
/var/log/spooler
{
sharedscripts
postrotate
/bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
endscript
}
[[email protected] logstash_conf]# cat /etc/logrotate.d/logstash
/nfsc/logtest/stg/applog/*/*out
/nfsc/logtest/stg/oslog/*/var/log/cron
/nfsc/logtest/stg/oslog/*/var/log/secure
/nfsc/logtest/stg/oslog/*/var/log/messages
{
sharedscripts
nocompress
create 2775 root root
size 10G
missingok
notifempty
copytruncate
dateext
postrotate
/bin/kill -HUP `cat /var/run/logstash.pid 2> /dev/null`
endscript
rotate 10
}
解释:
sharedscripts 表示上面的日志文件全部判断后才执行 kill -HUP 命令(否则每判断一次执行一次)
nocompress 表示不压缩
create 表示新创建,并设置权限
size 表示超过多大开始切分
notifempty 表示空文件不执行
dateext 表示以时间为后缀
rotate 10 表示切分后的保留的最多个数
copytruncate 先copy 再清空的方式,可能有少量的日志丢失(logstash 暂时没有sighup 重新加载配置文件的功能)
更多请:man logrotate
写入Crontab:
*/5 * * * * logrotate /etc/logrotate.d/logstash
模拟测试(不会真的执行):logrotate /etc/logrotate.d/logstash -d (如果加-f 就会忽略size 10G,强制执行)