Linux日志轮询问题

在IBM developerWorks中看到这么一段话：

Ready? Rotate!

You will see some files in the /var/log directory that end with a number. These are rotated archives. Log files can get rather large and cumbersome. Linux provides a command to rotate these logs so that you don't have current log information mixed with older irrelevant data. Generally logrotate runs automatically on a timed basis, but it can also be run manually. When executed, logrotate will take the current version of the log files and add a ".1" to the end of the filename. Then any other previously rotated files are sequenced with ".2," ".3," etc. The larger the number after a filename, the older the log is.

You can configure the automatic behavior for logrotate by editing the /etc/logrotate.conf file. Learn the full details about logrotate with man logrotate .

不甚明白，收集了一点网络资料于下：http://blog.chinaunix.net/u1/43502/showart_1960870.html

-----------------------------------------------------------------------------------------------------------

日志轮询是linux中对日志文件的一种处理方式，为防止日志文件过大造成一些应用的问题。

    日志轮询的原理是：按时间或者按文件大小，将日志文件更名，让应用将新的日志写入新的文件中，旧的日志文件可以设置保留一段时间以备检查。

    linux中日志轮询的服务是logrotate，主配置文件是/etc/logrotate.conf和/etc/logrotate.d中的文件。在 红旗所有系统中，日志轮询默认是每一周轮转一次日志，保留4个旧日志文件备份。

    如何将某日志文件按照文件大小轮转呢？

    比如：/var/log/httpd/access_log文件，当达到10M时就轮转一次。

    可以通过修改/etc/logrotate.d/httpd配置文件来解决。修改之后如下（其中添加了size=10M，rotate 4）：

/var/log/httpd/* log {     size=10M     rotate 4     missingok     notifempty     sharedscripts     postrotate         /bin/kill - HUP `cat /var/run/httpd. pid 2> / dev/null` 2> /dev/null | | true     endscript }

    那么测试一下，往/var/log/httpd/access_log中写入信息，直到此文件大小超过10M，但是没有所想像的会生成一个/var /log/httpd/access_log.1文件。为何？

    其实logrotate并非是一个daemon进程，所以logrotate不是时时监控这些日志文件的，而是通过crond计划任务来执行的：

[ root@ASIANUX3 logrotate. d] # cat /etc/cron. daily/logrotate #! / bin/sh /usr/sbin/logrotate /etc/logrotate. conf EXITVALUE= $ ? if [ $EXITVALUE ! = 0 ] ; then     /usr/bin/logger - t logrotate "ALERT exited abnormally with [$EXITVALUE]" fi exit 0 [ root@ASIANUX3 logrotate. d] #

可 见，是每天的4：02执行logrotate进行各日志文件检查，如果符合条件的，就会进行日志轮转。

为了验证刚才对httpd修改有效，可以手工执行/usr/sbin/logrotate /etc/logrotate.conf，就会看到/var/log/httpd/access_log.1文件生成了，原来/var/log /httpd/access_log大小变成了0。

 

问题：为何说logrotate是每天4：02执行一次呢？

答：/etc/crontab里面

      02 4 * * * root run-parts /etc/cron.daily

     /etc/cron.daily里有logrotate

-----------------------------------------------------------------------------------------------------------

我用的是ubuntu10.04，查看了一下相关文件：



xyf@xyf-laptop:~$ cat /etc/crontab

# /etc/crontab: system-wide crontab

# Unlike any other crontab you don't have to run the `crontab'

# command to install the new version when you edit this file

# and files in /etc/cron.d. These files also have username fields,

# that none of the other crontabs do.

SHELL=/bin/sh

PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

# m h dom mon dow user	command

17 *	* * *	root    cd / && run-parts --report /etc/cron.hourly

25 6	* * *	root	test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )

47 6	* * 7	root	test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )

52 6	1 * *	root	test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )

#



xyf@xyf-laptop:~$ cd /etc/cron.daily

xyf@xyf-laptop:/etc/cron.daily$ ls

0anacron  apache2  apport  apt  aptitude  bsdmainutils  dpkg  logrotate  man-db  mlocate  popularity-contest  standard