我有日誌輪換的問題。我正在使用 rsyslog 從某些 Cisco 套件收集相當大量的系統日誌資料。
標準系統日誌檔案可以正常旋轉/清理，但我新增的系統日誌檔案卻不能。這是我的設定檔：
user@server:/var/log/remote$ cat /etc/logrotate.d/rsyslog
/var/log/syslog
{
rotate 7
daily
missingok
notifempty
delaycompress
compress
postrotate
reload rsyslog >/dev/null 2>&1 || true
endscript
}
/var/log/mail.info
/var/log/mail.warn
/var/log/mail.err
/var/log/mail.log
/var/log/daemon.log
/var/log/kern.log
/var/log/auth.log
/var/log/user.log
/var/log/lpr.log
/var/log/cron.log
/var/log/debug
/var/log/messages
{
rotate 4
weekly
missingok
notifempty
compress
delaycompress
sharedscripts
postrotate
reload rsyslog >/dev/null 2>&1 || true
endscript
}
/var/log/remote/*
{
rotate 10
hourly
missingok
compress
delaycompress
sharedscripts
postrotate
reload rsyslog >/dev/null 2>&1 || true
endscript
}
幾天后，包含系統日誌檔案的目錄如下所示：
user@server:/var/log/remote$ ls -l
total 312464
-rw-r----- 1 syslog adm 72943939 Feb 16 12:16 10.108.0.17.log
-rw-r----- 1 syslog adm 0 Feb 16 07:47 10.108.0.17.log.1
-rw-r----- 1 syslog adm 0 Feb 16 07:47 10.108.0.17.log.1.1
-rw-r----- 1 syslog adm 183577555 Feb 16 07:47 10.108.0.17.log.1.1.1
-rw-r----- 1 syslog adm 2782878 Feb 15 07:47 10.108.0.17.log.1.2.gz
-rw-r----- 1 syslog adm 3180854 Feb 14 08:00 10.108.0.17.log.1.3.gz
-rw-r----- 1 syslog adm 0 Feb 16 07:47 10.108.0.17.log.2.gz
-rw-r----- 1 syslog adm 20 Feb 15 07:47 10.108.0.17.log.2.gz.1
-rw-r----- 1 syslog adm 33 Feb 14 08:00 10.108.0.17.log.2.gz.2.gz
-rw-r----- 1 syslog adm 0 Feb 16 07:47 10.108.0.17.log.3.gz
-rw-r----- 1 syslog adm 0 Feb 15 07:47 10.108.0.17.log.3.gz.1
-rw-r----- 1 syslog adm 15588585 Feb 13 07:40 10.108.0.17.log.4.gz
-rw-r----- 1 syslog adm 5950012 Feb 12 07:53 10.108.0.17.log.5.gz
-rw-r----- 1 syslog adm 7012651 Feb 16 12:16 als-gwy04.mmu.ac.uk.log
-rw-r----- 1 syslog adm 0 Feb 16 07:47 als-gwy04.mmu.ac.uk.log.1
-rw-r----- 1 syslog adm 0 Feb 16 07:47 als-gwy04.mmu.ac.uk.log.1.1
-rw-r----- 1 syslog adm 26187423 Feb 16 07:47 als-gwy04.mmu.ac.uk.log.1.1.1
-rw-r----- 1 syslog adm 20 Feb 14 08:00 als-gwy04.mmu.ac.uk.log.1.2.gz
-rw-r----- 1 syslog adm 20 Feb 13 07:40 als-gwy04.mmu.ac.uk.log.1.3.gz
-rw-r----- 1 syslog adm 0 Feb 16 07:47 als-gwy04.mmu.ac.uk.log.2.gz
-rw-r----- 1 syslog adm 20 Feb 15 07:47 als-gwy04.mmu.ac.uk.log.2.gz.1
-rw-r----- 1 syslog adm 33 Feb 14 08:00 als-gwy04.mmu.ac.uk.log.2.gz.2.gz
-rw-r----- 1 syslog adm 0 Feb 16 07:47 als-gwy04.mmu.ac.uk.log.3.gz
-rw-r----- 1 syslog adm 0 Feb 15 07:47 als-gwy04.mmu.ac.uk.log.3.gz.1
-rw-r----- 1 syslog adm 591717 Feb 12 12:36 als-gwy04.mmu.ac.uk.log.4.gz
-rw-r----- 1 syslog adm 2088688 Feb 12 07:53 als-gwy04.mmu.ac.uk.log.5.gz
user@server:/var/log/remote$
你知道為什麼他們要複製並獲得多個後綴而不是像這樣清理嗎？
user@server:/var/log$ ls -l sys*
-rw-r----- 1 syslog adm 624 Feb 16 12:17 syslog
-rw-r----- 1 syslog adm 3142 Feb 16 07:47 syslog.1
-rw-r----- 1 syslog adm 530 Feb 15 07:47 syslog.2.gz
-rw-r----- 1 syslog adm 546 Feb 14 08:00 syslog.3.gz
-rw-r----- 1 syslog adm 47042 Feb 13 07:40 syslog.4.gz
-rw-r----- 1 syslog adm 24152 Feb 12 07:53 syslog.5.gz
-rw-r----- 1 syslog adm 546 Feb 11 07:43 syslog.6.gz
-rw-r----- 1 syslog adm 534 Feb 10 07:38 syslog.7.gz
user@server:/var/log$ ^C
答案1
/var/log/remote/*最後一條規則符合所有文件，包括由其他規則建立的 *gz 。
例如，您應該製作更好的正規表示式10*.log或符合特定檔案。
如：
/var/log/remote/10*.log
{
rotate 10
hourly
missingok
compress
delaycompress
sharedscripts
postrotate
reload rsyslog >/dev/null 2>&1 || true
endscript
}