How to use logrotate to manage log files in linux（如何在Linux中使用logrotate去管理日志文件）

最新推荐文章于 2023-07-07 11:59:32 发布

charliye

最新推荐文章于 2023-07-07 11:59:32 发布

阅读量634

点赞数

分类专栏： Linux日常操作管理文章标签： Linux logrotate

Linux日常操作管理专栏收录该内容

9 篇文章 0 订阅

订阅专栏

Log files contain useful information about what is going on within the system. They are often inspected during troubleshooting processes or as part of server performance analysis. For a busy server, log files may grow quickly into very large sizes. This becomes a problem as the server will soon run out of space. Besides, opening and inspecting a single large log file can often be tricky.

日志文件包含了在系统中正在运行的有用的信息。他们经常在排错或者作为服务性能分析的一部分中被检查。对于一个繁忙的服务器来说，日志文件可能会很快的增长到非常大。这会成为一个问题，因为服务器将很快没有空间可用。除此之外，打开并且检查一个单独的很大的日志文件是恨棘手的。

Logrotate is a very useful tool that can automate the process of breaking up (or rotating), compressing, and deleting old log files. For example, you can set up logrotate such that the log file /var/log/foo is rotated every 30 days, and logs older than 6 months are deleted. Once configured, the process is fully automated using logrotatewithout any further need for human interaction. Optionally, old logs can be emailed as well, but that option is beyond the scope of this tutorial.

Logrotate是一个非常有用的工具，它可以自动分离（更迭），压缩以及删掉旧的日志文件。例如，你可以建立logrotate使得日志文件/var/log/foo每30天更迭一次，超过6个月的旧日志文件会被删掉。一旦配置好，这个进程是完全自动的使用logrotate而不需要任何更多的人工干预。

The logrotate package is typically installed by default on major Linux distros. If, for some reason, logrotate is not present, you can install it using apt-get or yum command.

Logrotate包在主要的Linux版本上是默认安装的。如果，由于一些因素，logrotate没有安装在系统上，你可以使用apt-get或者yum来安装它。

不同的系统下安装Logrotate的命令：

On Debian or Ubuntu:

  # apt-get install logrotate cron 

On Fedora, CentOS or RHEL:

  # yum install logrotate crontabs 

The configuration file for logrotate is /etc/logrotate.conf. Generally no modification is needed here. The log files to be rotated are defined in separate configuration file(s) placed under /etc/logrotate.d/ directory.

Logrotate的配置文件是/etc/logrotate.conf。这里通常是没有必要修改的。日志文件可以根据在/etc/logrotate.d目录下的不同的配置文件被更迭。

Example One

In the first example, we will create a 10 MB log file /var/log/log-file. We will see how we can use logrotate to manage this log file.

We start by creating a log file, and populating it with a 10 MB worth of random bit stream.

在第一个例子汇总，我们创建一个10MB的日志文件 /var/log/log-file。我们观察一下应该怎样使用logrotate去管理这个日志文件。我们首先创建一个日志文件，并用10MB随机的比特流来填满它。

  # touch /var/log/log-file 
 
 # head -c 10M < /dev/urandom > /var/log/log-file 

Now that the log file is ready, we will configure logrotate to rotate this log file. Let's create a configuration file for this.

现在这个日志文件已经就绪，我们配置logrotate来个更迭这个日志文件。让我们为它创建一个配置文件。

  # vim /etc/logrotate.d/log-file 

/var/log/log-file {
    monthly
    rotate 5
    compress
    delaycompress
    missingok
    notifempty
    create 644 root root
    postrotate
        /usr/bin/killall -HUP rsyslogd
    endscript
}

Where:

monthly: The log file will now be rotated monthly. Other possible values are 'daily', 'weekly' or 'yearly'.
日志文件将每个月更迭一次。其他可用的值有：每天，每周或者每年
rotate 5: A total of 5 archived logs will be stored at a time. For the 6th archive, the oldest stored archive will be deleted.
同时存在的存档日志文件的数目为5。对于第六个存档文件，最老的日志将被删除
compress: The rotated archive will be compressed using gzip, after the rotation task is complete.
在更迭任务完成之后，被更迭的存档文件将被使用gzip被压缩。
delaycompress: Always used together with compress option, the delaycompress parameter instructslogrotate to not run compression on the most recent archive. Compression will be performed during the next rotation cycle. This is useful if you or any software still needs to access the fresh archive.
一直和compress一起使用，这个delaycompress参数使logrotate在最近的存档的时候不执行压缩。压缩将会在下个更迭周期之中被完成。这个是非常有用的，如果你或者任何软件需要获取最新的存档日志。
missingok: During log rotation, any errors will be ignored, e.g., "file not found".
在日志更迭过程中，任何错误都将被忽略，比如文件未找到。
notifempty: Rotation will not be performed if the log file is empty.
如果日志文件为空，那么不会进行更迭。
create 644 root root: A fresh log file will be created with specified permissions as logrotate may rename the original log file.
一个新的已被指定权限的日志文件将会被创建，并且logrotate会重命名之前的日志文件。
postrotate/endscript: The command(s) specified between postrotate and endscript will be carried out after all other instructions are completed. In this case, the process rsyslogd will re-read its configuration on the fly and continue running.
在postrotate和endscript之间的特定命令将会在所有其他的指令完成之后执行。在这个例子中，这个进程rsyslogd将会重新读取他的配置文件并继续运行。

The above template is generic, and the configuration parameters may vary based on your requirements. Not all the parameters may be necessary.

上述的模板是通用的，并且配置参数可能是多样的依据你的需求。不是所有的参数都是必须的。

Example Two

In this example, we want to rotate a log file only when the size of the log file grows over 50 MB.

在这个例子中，我们想更迭一个日志文件仅仅当这个日志文件大小超过50MB。

  # vim /etc/logrotate.d/log-file 

/var/log/log-file {
    size=50M
    rotate 5
    create 644 root root
    postrotate
        /usr/bin/killall -HUP rsyslogd
    endscript
}

Example Three

We want old log files to be named with the date of creation. This can be achieved by adding dateext parameter.

我们想让旧的日志文件使用创建日期命名。这可以通过添加dateext参数实现。

  # vim /etc/logrotate.d/log-file 

/var/log/log-file {
    monthly
    rotate 5
    dateext
    create 644 root root
    postrotate
        /usr/bin/killall -HUP rsyslogd
    endscript
}

This will cause the archived files to contain the date in their name.

这可以使存档文件在他们的名字中包含日期。

Troubleshooting

Here are a few troubleshooting tips for logrotate setup.

这里是一些logroate安装的排错技巧。

1. Running logrotate manually 手动运行logrotate

logrotate can be invoked manually from the command line at any time.

logrotate可以在任何时间在命令行中被手动调用。

To invoke logrotate on all logs as configured in /etc/logrotate.d/*:

调用如/etc/logrotate.d/*中配置的logrotate

  # logrotate /etc/logrotate.conf 

To invoke logrotate for a particular configuration:

调用一个特定配置的logrotate

  # logrotate /etc/logrotate.d/log-file 

2. Dry run

The best option during troubleshooting is to run logrotate as a dry run using '-d' option. For verification, a dry runsimulates log rotation and displays its output without actually rotating any log files.

  # logrotate -d /etc/logrotate.d/log-file 

As we can see from the above output, logrotate decided that rotation is not necessary. This can happen if the age of the file is less than one day.

3. Force run

We can force logrotate to rotate log files even when rotation conditions are not met, by using '-f' option. The '-v' parameter provides verbose output.

即使在更迭条件并不满足的情况下，我们也可以强制使用logrotate中的-f选项去更迭日志文件。-v参数提供了详细的输出。

# logrotate -vf /etc/logrotate.d/log-file

reading config file /etc/logrotate.d/log-file
reading config info for /var/log/log-file

Handling 1 logs

rotating pattern: /var/log/log-file  forced from command line (5 rotations)
empty log files are rotated, old logs are removed
considering log /var/log/log-file
  log needs rotating
rotating log /var/log/log-file, log->rotateCount is 5
dateext suffix '-20140916'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
renaming /var/log/log-file.5.gz to /var/log/log-file.6.gz (rotatecount 5, logstart 1, i 5),
old log /var/log/log-file.5.gz does not exist
renaming /var/log/log-file.4.gz to /var/log/log-file.5.gz (rotatecount 5, logstart 1, i 4),
old log /var/log/log-file.4.gz does not exist
. . .
renaming /var/log/log-file.0.gz to /var/log/log-file.1.gz (rotatecount 5, logstart 1, i 0),
old log /var/log/log-file.0.gz does not exist
log /var/log/log-file.6.gz doesn't exist -- won't try to dispose of it
renaming /var/log/log-file to /var/log/log-file.1
creating new /var/log/log-file mode = 0644 uid = 0 gid = 0
running postrotate script
compressing log with: /bin/gzip

4. Logrotate logging

Logs for logrotate itself are usually stored in the directory /var/lib/logrotate/status. If we want logrotate to log to any specific file for troubleshooting purposes, we can specify that from the command line as follows.

logrotate自己的日志经常存储在/var/lib/logrotate/status目录下。如果我们使用logrotate为了排错需要去记录任何指定的文件，我们可以使用如下命令行去做。

  # logrotate -vf –s /var/log/logrotate-status /etc/logrotate.d/log-file 

5. Logrotate cron job

The cron jobs needed for logrotate should automatically be created during installation. I am posting the contents of the cron file for reference.

logrotate的计划任务需要在安装时自动的被创建。下面的是供参考的计划文件的内容。

  # cat /etc/cron.daily/logrotate 

#!/bin/sh

# Clean non existent log file entries from status file
cd /var/lib/logrotate
test -e status || touch status
head -1 status > status.clean
sed 's/"//g' status | while read logfile date
do
    [ -e "$logfile" ] && echo "\"$logfile\" $date"
done >> status.clean
mv status.clean status

test -x /usr/sbin/logrotate || exit 0
/usr/sbin/logrotate /etc/logrotate.conf

To sum up, logrotate is a very useful tool for preventing gigantic log files from using up storage space. Once configured, the process is fully automated, and can run without human intervention for a long time. This tutorial focused on several basic examples of how to use logrotate. You can customize it even further to match your requirements.

总的来说，logrotate是一个非常有用的工具去防止日志文件用光存储空间。一旦配置好，整个过程是全自动的，并且可以再没有人机交互的情况下运行很长时间。本文重点是几个使用logrotate的基础的例子。你可以根据你的需求去定制它。

Hope this helps.

希望这有所帮助。