☰

为什么 logrotate 会删除我的日志？

tag-icon • tag-icon apache-2.2 logging logrotate
为什么 logrotate 会删除我的日志？

这是我的会议：

/var/log/apache2/*.log {
        weekly
        missingok
        rotate 52
        compress
        delaycompress
        notifempty
        create 640 root adm
        sharedscripts
        postrotate
                if /etc/init.d/apache2 status > /dev/null ; then \
                    /etc/init.d/apache2 reload > /dev/null; \
                fi;
        endscript
        prerotate
                if [ -d /etc/logrotate.d/httpd-prerotate ]; then \
                        run-parts /etc/logrotate.d/httpd-prerotate; \
                fi; \
        endscript
}

如果我理解正确的话，它应该保存 52 周的价值日志（打包），但它们每周都会被删除。

我有 2 个虚拟主机，一个是 www，另一个是 test 子域。这是我从 sites-enabled conf 中告诉我的网站要登录的方式。

<VirtualHost *:80>
    ServerAdmin [email protected]
    ServerName test.xxx.com
    ServerAlias test.xxx.com
    DocumentRoot /var/www/test.xxx.com/public_html
    <Directory /var/www/test.xxx.com/public_html/>
        Options Indexes FollowSymLinks
        AllowOverride All
        Require all granted
    </Directory>
    AddDefaultCharset UTF-8
    ErrorLog ${APACHE_LOG_DIR}/test.xxx.com/error.log
    CustomLog ${APACHE_LOG_DIR}/test.xxx.com/access.log combined
</VirtualHost>

其中 xxx.com 是我的域名，而 test.xxx.com 文件夹确实存在于 apache 日志目录中。日志记录工作正常，但旧日志却消失了！

我logrotate -f -d /var/log/apache2/xxx.com/access.log按照@Craig Miskell 的建议做了。我得到的输出是：

    error: /var/log/apache2/xx.com/access.log:1 lines must begin with a keyword or a filename (possibly in double quotes)
    error: /var/log/apache2/xxx.com/access.log:2 lines must begin with a keyword or a filename (possibly in double quotes)
    error: /var/log/apache2/xxx.com/access.log:3 lines must begin with a keyword or a filename (possibly in double quotes)
    error: /var/log/apache2/xxx.com/access.log:4 lines must begin with a keyword or a filename (possibly in double quotes)
etc...

我打开了日志文件，一切似乎都很好。我甚至使用了一些名为 Apache Logs Viewer（在 Windows 上）的软件，这个程序也能很好地理解日志文件的原因。

所讨论的日志文件的前几行：

999.999.999.999 - - [26/Dec/2014:11:28:41 +0000] "GET /contact HTTP/1.1" 200 1622 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 OPR/26.0.1656.60"
999.999.999.999 - - [26/Dec/2014:11:31:01 +0000] "GET /contact HTTP/1.1" 200 1622 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 OPR/26.0.1656.60"
999.999.999.999 - - [26/Dec/2014:11:31:01 +0000] "GET /assets/css/normalize.css HTTP/1.1" 200 3034 "http://www.xxxxxx.com/contact" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 OPR/26.0.1656.60"
999.999.999.999 - - [26/Dec/2014:11:31:01 +0000] "GET /assets/css/skeleton.css HTTP/1.1" 200 4680 "http://www.xxxxxx.com/contact" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 OPR/26.0.1656.60"
999.999.999.999 - - [26/Dec/2014:11:31:01 +0000] "GET /assets/js/main.js HTTP/1.1" 200 1038 "http://www.xxxxxx.com/contact" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 OPR/26.0.1656.60"
999.999.999.999 - - [26/Dec/2014:11:31:01 +0000] "GET /assets/js/moment.js HTTP/1.1" 200 14752 "http://www.xxxxxx.com/contact" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 OPR/26.0.1656.60"
999.999.999.999 - - [26/Dec/2014:11:31:01 +0000] "GET /assets/images/logo-inverted.png HTTP/1.1" 200 1864 "http://www.xxxxxx.com/contact" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 OPR/26.0.1656.60"
999.999.999.999 - - [26/Dec/2014:11:31:01 +0000] "GET /assets/images/logo.png HTTP/1.1" 200 3681 "http://www.xxxxxx.com/contact" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 OPR/26.0.1656.60"

我更改了一些 IP 和域名，但其他一切都保持原样......

通过 Google 搜索该问题，看起来文件格式不正确（unix？），但我甚至不是写入文件或创建新文件的人，我怎么会创建错误呢？！

答案1

据我所知，* 通配符只能扩展到一个目录级别，不能扩展到更多。因此，在配置文件中使用：

/var/log/apache2/test.xxx.com/*.log {
    your config here
}

或者

/var/log/apache2/*/*.log {
        your config here
}

相关内容