转储Linux日志文件 （Rotating Linux Log Files - Part 0: Introduction）

http://www.ducea.com/2006/06/06/rotating-linux-log-files/

Logs… Any Linux system will generate many log files by default, containing various information about the operation of the system (normal actions, debugging information, security/authorization messages, web/email events, etc). If no rotation would occur on the various log files, then they will just grow bigger and bigger, filling up the space (on high traffic sites) but most importantly making it very difficult tofind any information that we might be looking for in those log files. Fortunately this is handled in most Linux distributions bydefault and we don’t have anything special to do to set it up… if will function out of the box, rotating the log files by default.

日志...任何Linux系统默认都会产生很多日志文件，包含各种各样的关于系统操作的信息（常规动作，调试信息，安全、授权消息，Web、电子邮件事件等）。如果不对这些日志文件转储，这些文件就会越来越大，耗尽磁盘空间（在高流量的站点），更重要的是会使得我们在这些文件中查找信息变得很困难。幸运的是，很多Linux发行版默认都已处理这个问题，我们不用去设置它。如果运行超出设定范围，会默认转储日志。

This little how-to will show you how the default log rotation works, based onsyslogand logrotate. There are other ways to achieve this, like usingsyslog-ng instead of syslog that I will cover in a future article. Understanding how the default setup works, will help you have an idea of what will happen andwhat logs will be rotated, when will this occur, and how long will they be kept. Also it will show you the places where you can make changes in case you need to do that (if you want to save some log for a longer time, or if you want to rotate it differently from the default). The examples I will present are taken from a Debian system, so if you are running a different system, they might differ a little, but not drastically (like you might have the cron setup to run at a different time, or keep a different number of log iterations by default).

这个小的怎么做博文会向你展示默认的日志转储怎么基于syslog和logrotate工作。当然还有其他方式可以做到，比如我会在将来的博文中介绍使用syslog-ng而不是syslog。理解默认设置如何工作，将有助于你明白会发生什么和什么时候什么日志会被转储，并且转储的日志会保留多久，还会告诉你可以在哪里做改动万一你需要这么做（如果你想让日志保存更长时间，或者想用不同于默认的方式转储日志）。我展示的这些例子来自于Debian系统，所以如果你在用其他系统，有可能有些不同，但不会完全不同（就像你可能在不同的时刻运行cron设置，或者默认有不同数目的日志迭代）。

I have split this article in two parts based on the way how the log rotation is handled:

基于日志转储的处理的不同方式，我把这篇文章分成两部分：

• system log files: most of the system log files are rotated bysyslogitself and not using logrotate. You will see here what are these log files, and how they are rotated.

• 系统日志文件：大多数系统日志文件通过syslog而不是logrotate来转储。你会看到那些日志文件属于这类，他们怎样被转储。
  

• application log files:logrotateis the default choice to rotate all the other log files. It can rotate the logs based on various parameters: daily, weekly, monthly, based on the size of the log, it can compress the logs to save space, etc.

• 应用程序日志文件：logrotate是转储其他日志文件的默认选择。它可以用不同的参数转储日志：每天，每周，每月，基于日志大小，它还可以压缩日志文件以节省空间等。