linux日志管理系统logrotate

linux日志管理系统logrotate

Description

logrotate is designed to ease administration of systems that generate large numbers of log files. It allows automatic rotation, compression, removal, and mailing of log files. Each log file may be handled daily, weekly,monthly, or when it grows too large.

logrotate旨在简化对生成大量日志文件的系统的管理。 它允许自动旋转，压缩，删除和邮寄日志文件。 每个日志文件可以每天，每周，每月或当它变得太大时处理。

Normally, logrotate is run as a daily cron job. It will not modify a log more than once in one day unless the criterion for that log is based on the log’s size and logrotate is being run more than once each day, or unless the -f or --force option is used.

一般情况下，logrotate是一个每日运行的定时任务。它不会在一天内多次处理log，除非log的配置是基于log的大小并且logrotate一天运行多次，或者使用logrotate -f/–force。

Configuration File

logrotate reads everything about the log files it should be handling from the series of configuration files specified on the command line. Each configuration file can set global options (local definitions override global ones, and later definitions override earlier ones) and specify logfiles to rotate. A simple configuration file looks like this:

logrotate从命令行中指定的一系列配置文件中读取应处理的日志文件的所有内容。每个配置文件都可以设置全局选项（本地定义覆盖全局选项，后面的定义覆盖之前的定义），并指定要旋转的日志文件，一个简单的配置文件如下：

     # sample logrotate configuration file
     compress                             // 全局变量，转储后需要压缩

     /var/log/messages {
         rotate 5                         // 最多转储5次
         weekly                           // 每周执行
         postrotate                       // 转储后要执行的脚本
             /usr/bin/killall -HUP syslogd
         endscript
     }

     "/var/log/httpd/access.log" /var/log/httpd/error.log {
         rotate 5
         mail [email protected]                  // 发送邮件
         size 100k                        // 大小大于100k时才进行转储
         sharedscripts                    // postrotate脚本只执行一次
         postrotate
             /usr/bin/killall -HUP httpd
         endscript
     }

     /var/log/news/* {
         monthly
         rotate 2
         olddir /var/log/news/old
         missingok
         postrotate
             kill -HUP `cat /var/run/inn.pid`
         endscript
         nocompress
     }

设置size、maxsize、minsize属性后什么时候会对log进行转储：

type	大小大于配置	时间大于配置	log大小大于配置 && 时间大于配置
minisize	×	×	√
maxsize	√	√	√
size	√	×	√

ps：以syslog为例：这里指的大小是/var/log/syslog文件的大小；时间是/var/log/syslog与上次转储的差是否大于配置的周期。

File

/var/lib/logrotate/status Default state file. 默认状态，记录了转储踪迹。
/etc/logrotate.conf Configuration options.

使用logrotate配置自定义log

1：新建自定义的conf：
比如在/home/yms/exercise/logrotate/下新建yms.conf,监听yms.log

/home/yms/exercise/logrotate/yms.log
{
        rotate 7
        maxsize 5k
        missingok
        notifempty
        delaycompress
        compress
        postrotate
                echo "yms logrotatte done!!!"
        endscript
}

2：模拟环境
新建yms.log，并写入内容，使之大于5k。
3: 手动执行

执行命令 logrotate /home/yms/exercise/logrotate/yms --state /home/yms/exercise/logrotate/logrotate-state --verbose

查看执行结果：

reading config file /home/yms/exercise/logrotate/yms

Handling 1 logs

rotating pattern: /home/yms/exercise/logrotate/yms.log
 1048576 bytes (7 rotations)
empty log files are not rotated, log files >= 5120 are rotated earlier, old logs are removed
considering log /home/yms/exercise/logrotate/yms.log
  log needs rotating
rotating log /home/yms/exercise/logrotate/yms.log, log->rotateCount is 7
dateext suffix '-20181105'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
previous log /home/yms/exercise/logrotate/yms.log.1 does not exist
renaming /home/yms/exercise/logrotate/yms.log.7.gz to /home/yms/exercise/logrotate/yms.log.8.gz (rotatecount 7, logstart 1, i 7),
old log /home/yms/exercise/logrotate/yms.log.7.gz does not exist
renaming /home/yms/exercise/logrotate/yms.log.6.gz to /home/yms/exercise/logrotate/yms.log.7.gz (rotatecount 7, logstart 1, i 6),
old log /home/yms/exercise/logrotate/yms.log.6.gz does not exist
renaming /home/yms/exercise/logrotate/yms.log.5.gz to /home/yms/exercise/logrotate/yms.log.6.gz (rotatecount 7, logstart 1, i 5),
old log /home/yms/exercise/logrotate/yms.log.5.gz does not exist
renaming /home/yms/exercise/logrotate/yms.log.4.gz to /home/yms/exercise/logrotate/yms.log.5.gz (rotatecount 7, logstart 1, i 4),
old log /home/yms/exercise/logrotate/yms.log.4.gz does not exist
renaming /home/yms/exercise/logrotate/yms.log.3.gz to /home/yms/exercise/logrotate/yms.log.4.gz (rotatecount 7, logstart 1, i 3),
old log /home/yms/exercise/logrotate/yms.log.3.gz does not exist
renaming /home/yms/exercise/logrotate/yms.log.2.gz to /home/yms/exercise/logrotate/yms.log.3.gz (rotatecount 7, logstart 1, i 2),
old log /home/yms/exercise/logrotate/yms.log.2.gz does not exist
renaming /home/yms/exercise/logrotate/yms.log.1.gz to /home/yms/exercise/logrotate/yms.log.2.gz (rotatecount 7, logstart 1, i 1),
old log /home/yms/exercise/logrotate/yms.log.1.gz does not exist
renaming /home/yms/exercise/logrotate/yms.log.0.gz to /home/yms/exercise/logrotate/yms.log.1.gz (rotatecount 7, logstart 1, i 0),
old log /home/yms/exercise/logrotate/yms.log.0.gz does not exist
log /home/yms/exercise/logrotate/yms.log.8.gz doesn't exist -- won't try to dispose of it
renaming /home/yms/exercise/logrotate/yms.log to /home/yms/exercise/logrotate/yms.log.1
running postrotate script
yms logrotatte done!!!

可以看到打印，说明已成功执行。

4：配置到定时任务cron中
crontab -e增加定时任务

10 * * * * /usr/sbin/logrotate /home/yms/exercise/logrotate/yms --state /home/yms/exercise/logrotate/logrotate-state --verbose //每小时的第10分钟进行执行