☰

/var/log 的日志轮换

tag-icon • tag-icon server root disk-usage log logrotate
/var/log 的日志轮换

我收到一条警告，说根目录空间不足。使用北卡罗莱纳大学我发现 /var/log 文件夹占用了很多空间。然后进一步检查发现syslog 和 kern.log占用太多空间。因此，我跟踪了两者的日志，发现它们被持续写入且速度太快，我的问题是每行日志信息非常相似，以至于我手动检查了超过 300 行日志信息

Sep 10 00:50:02 amsabots kernel: [ 2421.158588] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.158645] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.158703] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.158738] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.164080] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.164226] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.164266] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.164324] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.164384] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.164443] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.164503] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.164545] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.164583] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.164688] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.164782] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.164842] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.164900] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.164960] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.165020] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.165078] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.165138] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.165175] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.170990] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.171140] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.171188] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.171290] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.171338] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.171381] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.171500] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.171646] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.171739] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.171799] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.171858] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.171917] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.171976] dpc 0000:00:1d.0:pcie010: DPC containment event, status:0x1f00 source:0x0000
Sep 10 00:50:02 amsabots kernel: [ 2421.172033] dpc 0000:00:1^C

我已经尝试了多种解决方案来解决这个问题，但似乎没有一个能真正解决问题。我希望进一步澄清的建议如下：

  1. 提供一个文件大小限制改为 1gb 之类的值到 /etc/logrotate.d/rsyslog - 这会将所有 syslog 的日志文件大小限制为 1gb，如果超过则进行轮换
  2. 将 kern.log 和 auth.log 的 logrotate 设置为每日，并将 sysylog、kern.log 和 auth.log 的轮换文件数量减少到 2。
/var/log/syslog
{
    rotate 7
    daily
    missingok
    notifempty
    delaycompress
    compress
    postrotate
        /usr/lib/rsyslog/rsyslog-rotate
    endscript
}

/var/log/mail.info
/var/log/mail.warn
/var/log/mail.err
/var/log/mail.log
/var/log/daemon.log
/var/log/kern.log
/var/log/auth.log
/var/log/user.log
/var/log/lpr.log
/var/log/cron.log
/var/log/debug
/var/log/messages
{
    rotate 4
    weekly
    missingok
    notifempty
    compress
    delaycompress
    sharedscripts
    postrotate
        /usr/lib/rsyslog/rsyslog-rotate
    endscript
}

关于我上面列出的变化的影响，有什么建议吗？

答案1

首先安装 stacer：打开 stacer 并转到“系统清理器”，单击“全选”，然后单击其上方的蓝色按钮。然后单击“全选”，然后单击蓝色按钮。输入您的密码，即可完成。

相关内容