☰

Centos7 停止臃腫的日誌記錄

tag-icon • tag-icon logging centos7 syslog rsyslog
Centos7 停止臃腫的日誌記錄

我有一台作業系統為 Centos 7 的伺服器，正在查看日誌文件，例如訊息日誌文件(“/var/log/messages”)我可以看到它主要充滿瞭如下條目：

Aug 29 12:46:01 localhost systemd: Created slice user-48.slice.
Aug 29 12:46:01 localhost systemd: Starting user-48.slice.
Aug 29 12:46:01 localhost systemd: Started Session 984866 of user apache.
Aug 29 12:46:01 localhost systemd: Starting Session 984866 of user apache.
Aug 29 12:46:01 localhost systemd: Started Session 984868 of user apache.
Aug 29 12:46:01 localhost systemd: Starting Session 984868 of user apache.
Aug 29 12:46:01 localhost systemd: Started Session 984867 of user apache.
Aug 29 12:46:01 localhost systemd: Starting Session 984867 of user apache.
Aug 29 12:46:01 localhost systemd: Started Session 984869 of user apache.
Aug 29 12:46:01 localhost systemd: Starting Session 984869 of user apache.
Aug 29 12:46:02 localhost systemd: Removed slice user-48.slice.
Aug 29 12:46:02 localhost systemd: Stopping user-48.slice.
Aug 29 12:47:01 localhost kernel: audit_printk_skb: 51 callbacks suppressed
Aug 29 12:47:01 localhost kernel: type=1101 audit(1535543221.712:13161497): pid=45989 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct="apache" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
Aug 29 12:47:01 localhost kernel: type=1101 audit(1535543221.712:13161499): pid=45992 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct="apache" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
Aug 29 12:47:01 localhost kernel: type=1101 audit(1535543221.743:13161500): pid=45991 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_localuser acct="apache" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
Aug 29 12:47:01 localhost kernel: type=1103 audit(1535543221.749:13161502): pid=45989 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred grantors=pam_env,pam_unix acct="apache" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
Aug 29 12:47:01 localhost kernel: audit: audit_lost=6572998 audit_rate_limit=0 audit_backlog_limit=320
Aug 29 12:47:01 localhost kernel: audit: printk limit exceeded

現在，這些訊息對我自己來說看起來不太有用，因此如果我是正確的，我想停止記錄它。

我想知道我對這些訊息缺乏用處的假設是否正確，如果是，我將如何阻止這些訊息被記錄？

我的/etc/rsyslog.conf內容：

# rsyslog configuration file

# For more information see /usr/share/doc/rsyslog-*/rsyslog_conf.html
# If you experience problems, see http://www.rsyslog.com/doc/troubleshoot.html

#### MODULES ####

# The imjournal module bellow is now used as a message source instead of imuxsock.
$ModLoad imuxsock # provides support for local system logging (e.g. via logger command)
$ModLoad imjournal # provides access to the systemd journal
#$ModLoad imklog # reads kernel messages (the same are read from journald)
#$ModLoad immark  # provides --MARK-- message capability

# Provides UDP syslog reception
#$ModLoad imudp
#$UDPServerRun 514

# Provides TCP syslog reception
#$ModLoad imtcp
#$InputTCPServerRun 514


#### GLOBAL DIRECTIVES ####

# Where to place auxiliary files
$WorkDirectory /var/lib/rsyslog

# Use default timestamp format
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# File syncing capability is disabled by default. This feature is usually not required,
# not useful and an extreme performance hit
#$ActionFileEnableSync on

# Include all config files in /etc/rsyslog.d/
$IncludeConfig /etc/rsyslog.d/*.conf

# Turn off message reception via local log socket;
# local messages are retrieved through imjournal now.
$OmitLocalLogging on

# File to store the position in the journal
$IMJournalStateFile imjournal.state


#### RULES ####

# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                                 /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none                /var/log/messages

# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure

# Log all the mail messages in one place.
mail.*                                                  -/var/log/maillog


# Log cron stuff
cron.*                                                  /var/log/cron

# Everybody gets emergency messages
*.emerg                                                 :omusrmsg:*

# Save news errors of level crit and higher in a special file.
uucp,news.crit                                          /var/log/spooler

# Save boot messages also to boot.log
local7.*                                                /var/log/boot.log

我的系統日誌：

/var/log/cron
/var/log/maillog
/var/log/messages
/var/log/secure
/var/log/spooler
{
    missingok
    sharedscripts
    postrotate
    /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
    endscript
}

答案1

我不使用 CentOS，但它可能會systemd與journald和 一起運行rsyslog。其中每一個都可以配置為日誌記錄，但最接近最終檔案的/var/log/messages可能是/etc/rsyslog.conf.這可能有一行，例如：

*.info;mail.none;authpriv.none;cron.none   /var/log/messages

您可以替換*.info為不同級別，例如*.warning. （等級是：emergalertcriterr警告通知訊息debug）。您必須使用以下命令重新啟動守護進程

sudo systemctl status rsyslogd

這就是您需要更改的所有內容，但為了完整起見，這裡還有其他 2 個通常不會更改的配置。

使用 systemd，您可能還會以/var/log/journal/.這是由文件/etc/systemd/journald.conf（和其他文件，請參閱 參考資料man journald.conf）配置的，您可以編輯該文件以添加行，例如，

MaxLevelSyslog=warning

降低預設級別debug，允許將所有訊息發送到系統日誌，並按照上面的討論進行過濾。sudo systemctl restart systemd-journald如果您對此文件進行更改，您可能需要 a 。

該文件/etc/systemd/system.conf（請參閱 參考資料man systemd-system.conf）還有一行用於記錄從 systemd 記錄的訊息，即預設情況下

LogLevel=info

這也是可以改變的。您可能需要重新啟動才能重新讀取該檔案。

相關內容