☰

配置了 cron 作业后 Logrotate 无法与“Maxsize”配合使用

tag-icon • tag-icon centos logging cron log-files logrotate
配置了 cron 作业后 Logrotate 无法与“Maxsize”配合使用

提前致谢。我有一台充当 syslog-ng 服务器的服务器，并从多个网络设备接收日志。这些文件的大小迅速增加，因此我使用以下配置创建了 logrotate 文件。

    /syslog-ng/logs/devices/*.log
 {
   maxsize 10M
   notifempty                 # Do not rotate the log if it is empty
   compress                   # Old versions of log files are compressed with gzip
   hourly                     # Interval
   dateext                    # Archive old versions of log files adding a daily extension
   missingok                  # If the log file is missing, go on to the next one without issuing an error message
   rotate 5
   postrotate
   /bin/kill -HUP `cat /var/run/syslogd.pid 2>/dev/null` 2 >/dev/null || true endscript
   endscript
}

我希望它在一小时后或任何日志文件的大小达到 10 MB 时轮换。然而这并没有发生。我了解到 logrotate 需要由 cron 作业运行才能生效，因此我将以下条目添加到

    /etc/cron.d/
[root@proem cron.d]# cat syslog-logrotate-15mins
*/10 * * * * root /usr/sbin/logrotate /etc/logrotate.d/splunk-logrotate >/dev/null 2>&1

文件仍然达到 200 和 300 MB，而 logrotate 却没有生效，但是每小时 logrotate 正在运行，并且最大大小没有任何效果。

如果你查看要轮换的目录内的文件

total 2441816
drwxr-x--- 2 bin bin      8192 May 28 11:50 .
drwxr-x--- 3 bin bin        21 May  7 11:31 ..
-rw------- 1 bin bin 288410030 May 28 12:00 ASA-10.40.36.19.log
-rw------- 1 bin bin   9160117 May 28 07:00 ASA-10.40.36.19.log-2019052807.gz
-rw------- 1 bin bin  10237580 May 28 08:00 ASA-10.40.36.19.log-2019052808.gz
-rw------- 1 bin bin  19497590 May 28 09:00 ASA-10.40.36.19.log-2019052809.gz
-rw------- 1 bin bin  25640952 May 28 10:00 ASA-10.40.36.19.log-2019052810.gz
-rw------- 1 bin bin  24734338 May 28 11:00 ASA-10.40.36.19.log-2019052811.gz
-rw------- 1 bin bin    292677 May 28 11:59 ASA-10.40.36.20.log
-rw------- 1 bin bin      4763 May 28 06:51 ASA-10.40.36.20.log-2019052807.gz
-rw------- 1 bin bin       627 May 28 07:55 ASA-10.40.36.20.log-2019052808.gz
-rw------- 1 bin bin      4842 May 28 08:59 ASA-10.40.36.20.log-2019052809.gz
-rw------- 1 bin bin      9432 May 28 09:59 ASA-10.40.36.20.log-2019052810.gz
-rw------- 1 bin bin      8106 May 28 10:59 ASA-10.40.36.20.log-2019052811.gz
-rw------- 1 bin bin   4085275 May 28 06:59 Bluecoat-proxy.log-2019052807.gz
-rw------- 1 bin bin   4695767 May 28 08:00 Bluecoat-proxy.log-2019052808.gz
-rw------- 1 bin bin  13686609 May 28 09:00 Bluecoat-proxy.log-2019052809.gz
-rw------- 1 bin bin  18211983 May 28 10:00 Bluecoat-proxy.log-2019052810.gz
-rw------- 1 bin bin   9524946 May 28 10:35 Bluecoat-proxy.log-2019052811.gz
-rw------- 1 bin bin 403974411 May 28 12:00 Firepower-10.40.82.15.log
-rw------- 1 bin bin   6592767 May 28 06:59 Firepower-10.40.82.15.log-2019052807.gz
-rw------- 1 bin bin   7364536 May 28 07:59 Firepower-10.40.82.15.log-2019052808.gz
-rw------- 1 bin bin  14523366 May 28 09:00 Firepower-10.40.82.15.log-2019052809.gz
-rw------- 1 bin bin  19629133 May 28 09:59 Firepower-10.40.82.15.log-2019052810.gz
-rw------- 1 bin bin  19185954 May 28 10:59 Firepower-10.40.82.15.log-2019052811.gz
-rw------- 1 bin bin    184590 May 28 11:59 Firepower-10.40.82.25.log
-rw------- 1 bin bin      6146 May 28 06:59 Firepower-10.40.82.25.log-2019052807.gz
-rw------- 1 bin bin      6319 May 28 07:59 Firepower-10.40.82.25.log-2019052808.gz
-rw------- 1 bin bin      5441 May 28 08:59 Firepower-10.40.82.25.log-2019052809.gz
-rw------- 1 bin bin      5220 May 28 09:59 Firepower-10.40.82.25.log-2019052810.gz
-rw------- 1 bin bin      5225 May 28 10:59 Firepower-10.40.82.25.log-2019052811.gz
-rw------- 1 bin bin 633384651 May 28 12:00 Paloalto-10.40.82.18.log
-rw------- 1 bin bin   5603673 May 28 07:00 Paloalto-10.40.82.18.log-2019052807.gz
-rw------- 1 bin bin   5722379 May 28 08:00 Paloalto-10.40.82.18.log-2019052808.gz
-rw------- 1 bin bin   6466792 May 28 09:00 Paloalto-10.40.82.18.log-2019052809.gz
-rw------- 1 bin bin   7398515 May 28 10:00 Paloalto-10.40.82.18.log-2019052810.gz
-rw------- 1 bin bin  39241773 May 28 11:00 Paloalto-10.40.82.18.log-2019052811.gz

如果您注意到它每小时旋转一次并且最大尺寸条目没有任何效果。

我尝试执行 logrotate -d 只是为了查看并向您显示详细信息

[root@proem logrotate.d]# logrotate -d splunk-logrotate
reading config file splunk-logrotate
Allocating hash table for state file, size 15360 B

Handling 1 logs

    rotating pattern: /syslog-ng/logs/devices/*.log
      hourly (5 rotations)
    empty log files are not rotated, log files >= 10485760 are rotated earlier, old logs are removed
    considering log /syslog-ng/logs/devices/ASA-10.40.36.19.log
      log needs rotating
    considering log /syslog-ng/logs/devices/ASA-10.40.36.20.log
      log does not need rotating (log has been already rotated)considering log /syslog-ng/logs/devices/Firepower-10.40.82.15.log
      log needs rotating
    considering log /syslog-ng/logs/devices/Firepower-10.40.82.25.log
      log does not need rotating (log has been already rotated)considering log /syslog-ng/logs/devices/Paloalto-10.40.82.18.log
      log needs rotating
    rotating log /syslog-ng/logs/devices/ASA-10.40.36.19.log, log->rotateCount is 5
    dateext suffix '-2019052811'
    glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
    destination /syslog-ng/logs/devices/ASA-10.40.36.19.log-2019052811.gz already exists, skipping rotation
    rotating log /syslog-ng/logs/devices/Firepower-10.40.82.15.log, log->rotateCount is 5
    dateext suffix '-2019052811'
    glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
    destination /syslog-ng/logs/devices/Firepower-10.40.82.15.log-2019052811.gz already exists, skipping rotation
    rotating log /syslog-ng/logs/devices/Paloalto-10.40.82.18.log, log->rotateCount is 5
    dateext suffix '-2019052811'
    glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
    destination /syslog-ng/logs/devices/Paloalto-10.40.82.18.log-2019052811.gz already exists, skipping rotation

只有每小时一次的 logrotate 有效。我尝试了“Size”和“maxsize”，效果相同。我还在每小时一次的 cron 作业中添加了 logrotate 脚本。感谢您的帮助。

答案1

当运行 logrotate 时，如果文件超出最大大小，它完全有可能尝试旋转，但是由于dateext只有每小时的部分，这会导致先前旋转的文件被覆盖。

我建议添加一行配置：

dateformat -%Y%m%d%H%M

因此分钟也构成旋转文件名的一部分。

相关内容