提前致谢。我有一台充当 syslog-ng 服务器的服务器，并从多个网络设备接收日志。这些文件的大小迅速增加，因此我使用以下配置创建了 logrotate 文件。
/syslog-ng/logs/devices/*.log
{
maxsize 10M
notifempty # Do not rotate the log if it is empty
compress # Old versions of log files are compressed with gzip
hourly # Interval
dateext # Archive old versions of log files adding a daily extension
missingok # If the log file is missing, go on to the next one without issuing an error message
rotate 5
postrotate
/bin/kill -HUP `cat /var/run/syslogd.pid 2>/dev/null` 2 >/dev/null || true endscript
endscript
}
我希望它在一小时后或任何日志文件的大小达到 10 MB 时轮换。然而这并没有发生。我了解到 logrotate 需要由 cron 作业运行才能生效，因此我将以下条目添加到
/etc/cron.d/
[root@proem cron.d]# cat syslog-logrotate-15mins
*/10 * * * * root /usr/sbin/logrotate /etc/logrotate.d/splunk-logrotate >/dev/null 2>&1
文件仍然达到 200 和 300 MB，而 logrotate 却没有生效，但是每小时 logrotate 正在运行，并且最大大小没有任何效果。
如果你查看要轮换的目录内的文件
total 2441816
drwxr-x--- 2 bin bin 8192 May 28 11:50 .
drwxr-x--- 3 bin bin 21 May 7 11:31 ..
-rw------- 1 bin bin 288410030 May 28 12:00 ASA-10.40.36.19.log
-rw------- 1 bin bin 9160117 May 28 07:00 ASA-10.40.36.19.log-2019052807.gz
-rw------- 1 bin bin 10237580 May 28 08:00 ASA-10.40.36.19.log-2019052808.gz
-rw------- 1 bin bin 19497590 May 28 09:00 ASA-10.40.36.19.log-2019052809.gz
-rw------- 1 bin bin 25640952 May 28 10:00 ASA-10.40.36.19.log-2019052810.gz
-rw------- 1 bin bin 24734338 May 28 11:00 ASA-10.40.36.19.log-2019052811.gz
-rw------- 1 bin bin 292677 May 28 11:59 ASA-10.40.36.20.log
-rw------- 1 bin bin 4763 May 28 06:51 ASA-10.40.36.20.log-2019052807.gz
-rw------- 1 bin bin 627 May 28 07:55 ASA-10.40.36.20.log-2019052808.gz
-rw------- 1 bin bin 4842 May 28 08:59 ASA-10.40.36.20.log-2019052809.gz
-rw------- 1 bin bin 9432 May 28 09:59 ASA-10.40.36.20.log-2019052810.gz
-rw------- 1 bin bin 8106 May 28 10:59 ASA-10.40.36.20.log-2019052811.gz
-rw------- 1 bin bin 4085275 May 28 06:59 Bluecoat-proxy.log-2019052807.gz
-rw------- 1 bin bin 4695767 May 28 08:00 Bluecoat-proxy.log-2019052808.gz
-rw------- 1 bin bin 13686609 May 28 09:00 Bluecoat-proxy.log-2019052809.gz
-rw------- 1 bin bin 18211983 May 28 10:00 Bluecoat-proxy.log-2019052810.gz
-rw------- 1 bin bin 9524946 May 28 10:35 Bluecoat-proxy.log-2019052811.gz
-rw------- 1 bin bin 403974411 May 28 12:00 Firepower-10.40.82.15.log
-rw------- 1 bin bin 6592767 May 28 06:59 Firepower-10.40.82.15.log-2019052807.gz
-rw------- 1 bin bin 7364536 May 28 07:59 Firepower-10.40.82.15.log-2019052808.gz
-rw------- 1 bin bin 14523366 May 28 09:00 Firepower-10.40.82.15.log-2019052809.gz
-rw------- 1 bin bin 19629133 May 28 09:59 Firepower-10.40.82.15.log-2019052810.gz
-rw------- 1 bin bin 19185954 May 28 10:59 Firepower-10.40.82.15.log-2019052811.gz
-rw------- 1 bin bin 184590 May 28 11:59 Firepower-10.40.82.25.log
-rw------- 1 bin bin 6146 May 28 06:59 Firepower-10.40.82.25.log-2019052807.gz
-rw------- 1 bin bin 6319 May 28 07:59 Firepower-10.40.82.25.log-2019052808.gz
-rw------- 1 bin bin 5441 May 28 08:59 Firepower-10.40.82.25.log-2019052809.gz
-rw------- 1 bin bin 5220 May 28 09:59 Firepower-10.40.82.25.log-2019052810.gz
-rw------- 1 bin bin 5225 May 28 10:59 Firepower-10.40.82.25.log-2019052811.gz
-rw------- 1 bin bin 633384651 May 28 12:00 Paloalto-10.40.82.18.log
-rw------- 1 bin bin 5603673 May 28 07:00 Paloalto-10.40.82.18.log-2019052807.gz
-rw------- 1 bin bin 5722379 May 28 08:00 Paloalto-10.40.82.18.log-2019052808.gz
-rw------- 1 bin bin 6466792 May 28 09:00 Paloalto-10.40.82.18.log-2019052809.gz
-rw------- 1 bin bin 7398515 May 28 10:00 Paloalto-10.40.82.18.log-2019052810.gz
-rw------- 1 bin bin 39241773 May 28 11:00 Paloalto-10.40.82.18.log-2019052811.gz
如果您注意到它每小时旋转一次并且最大尺寸条目没有任何效果。
我尝试执行 logrotate -d 只是为了查看并向您显示详细信息
[root@proem logrotate.d]# logrotate -d splunk-logrotate
reading config file splunk-logrotate
Allocating hash table for state file, size 15360 B
Handling 1 logs
rotating pattern: /syslog-ng/logs/devices/*.log
hourly (5 rotations)
empty log files are not rotated, log files >= 10485760 are rotated earlier, old logs are removed
considering log /syslog-ng/logs/devices/ASA-10.40.36.19.log
log needs rotating
considering log /syslog-ng/logs/devices/ASA-10.40.36.20.log
log does not need rotating (log has been already rotated)considering log /syslog-ng/logs/devices/Firepower-10.40.82.15.log
log needs rotating
considering log /syslog-ng/logs/devices/Firepower-10.40.82.25.log
log does not need rotating (log has been already rotated)considering log /syslog-ng/logs/devices/Paloalto-10.40.82.18.log
log needs rotating
rotating log /syslog-ng/logs/devices/ASA-10.40.36.19.log, log->rotateCount is 5
dateext suffix '-2019052811'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
destination /syslog-ng/logs/devices/ASA-10.40.36.19.log-2019052811.gz already exists, skipping rotation
rotating log /syslog-ng/logs/devices/Firepower-10.40.82.15.log, log->rotateCount is 5
dateext suffix '-2019052811'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
destination /syslog-ng/logs/devices/Firepower-10.40.82.15.log-2019052811.gz already exists, skipping rotation
rotating log /syslog-ng/logs/devices/Paloalto-10.40.82.18.log, log->rotateCount is 5
dateext suffix '-2019052811'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
destination /syslog-ng/logs/devices/Paloalto-10.40.82.18.log-2019052811.gz already exists, skipping rotation
只有每小时一次的 logrotate 有效。我尝试了“Size”和“maxsize”，效果相同。我还在每小时一次的 cron 作业中添加了 logrotate 脚本。感谢您的帮助。
答案1
当运行 logrotate 时，如果文件超出最大大小，它完全有可能尝试旋转，但是由于dateext只有每小时的部分，这会导致先前旋转的文件被覆盖。
我建议添加一行配置：
dateformat -%Y%m%d%H%M
因此分钟也构成旋转文件名的一部分。