Shulou(Shulou.com)05/31 Report--

This article mainly explains "what is the logrotate of Linux". The content of the explanation is simple and clear, and it is easy to learn and understand. Please follow the editor's train of thought to study and learn "what is the logrotate of Linux".

Log in to the web service, df-h, and sure enough, a share is burst again.

Root@websrv001 ~ # df-h Filesystem Size Used Avail Use% Mounted on / dev/mapper/rootvg-rootvol 12G 5.6G 5.6G 50% / tmpfs 14G 014G 0% / dev/shm / dev/sda1 477M 84M 368M 19% / boot / dev/mapper/rootvg-homevol 2.0G 4.0m 1.9G 1% / local/home / dev/mapper/rootvg-tmpvol 1.1G 252M 793M 25% / tmp / dev/mapper/rootvg-varvol 5.8G 1.1G 4.5G 20% / var/ dev/mapper/fsvol 298G 298G 0100% / net/fsvol tmpfs 14G 0 14G 0% / var/tmp

Last time, it was because liferay's log was too big. This time, look at liferay's log.

Root@websrv001 ~ # ll-h / data/tomcat/storage/BU001/liferay/logs/ total 199m drwxr-xr-x 2 tomcat tomcat 4.0K Apr 20 13:14. Drwxr-xr-x 5 tomcat tomcat 4.0K Mar 14 2016.. -rw-r--r-- 1 tomcat tomcat 1.5m Apr 13 23:59 liferay.2020-04-13.log.gzipped_on_2020-04-17.gz-rw-r--r-- 1 tomcat tomcat 2.5m Apr 14 23:59 liferay.2020-04-14.log.gzipped_on_2020-04-18.gz-rw-r--r-- 1 tomcat tomcat 7.8m Apr 15 23:59 liferay.2020-04-15.log. 04-19.gz-rw-r--r-- 1 tomcat tomcat 31m Apr 17 23:58 liferay.2020-04-17.log-rw-r--r-- 1 tomcat tomcat 7.0m Apr 18 23:59 liferay.2020-04-18.log-rw-r--r-- 1 tomcat tomcat 90G Apr 20 17:54 liferay.2020-04-20.log

Let me make a list, Nima, a liferay log file that can grow to 90 gigabytes, which is ridiculous. Delete it decisively, I don't know why, whenever I want to knock rm-rf, I feel inexplicably nervous.

Root@websrv001 ~ # rm-rf / data/tomcat/storage/BU001/liferay/logs/liferay.2020-04-20.log

Restart the service

Root@websrv001 ~ # service tomcat restart

Then I informed the buddy of the development team that the server disk had been cleaned, the service had been restarted, and the web service was confirmed to be alive and ready to use. Then, I checked other folders and found that the log file catalina.out was super big again: 89G, I was also drunk.

Root@websrv001 ~ # ll-h / data/tomcat/server/BU001/logs/ total 104G drwxrwxr-x 2 root tomcat 12K Apr 20 04:45. Drwxr-xr-x 13 root root 4.0K Apr 16 17:26.. -rw-r--r-- 1 tomcat tomcat 5.1K Apr 13 10:28 catalina.2020-04-13.log.gz-rw-r--r-- 1 tomcat tomcat 13K Apr 14 20:46 catalina.2020-04-14.log.gz-rw-r--r-- 1 tomcat tomcat 7.1K Apr 16 17:51 catalina.2020-04-16.log.gz-rw-r--r-- 1 tomcat tomcat 89G Apr 20 10:39 catalina.out- Rw-r--r-- 1 tomcat tomcat 0 Feb 10 23:57 catalina.out-20200210-rw-r--r-- 1 tomcat tomcat 352M Apr 13 03:38 catalina.out-20200413

Although the problem was solved, it should not have happened in the first place. Didn't my colleagues in operation and maintenance do script to monitor and limit the size of the log? This is a production system! I can't do this. Since there's no one to do it, I'll do it. So I searched the Internet, and it turned out that the Linux system came with a log cutting artifact-- > logrotate.

Man took a look at logrotate and saw the following description: logrotate is designed to ease administration of systems that generate large numbers of log files. It allows automatic rotation, compression, removal, and mailing of log files. Each log file may be handled daily, weekly, monthly, or when it grows too large.

Normally, logrotate is run as a daily cron job. It will not modify a log more than once in one day unless the criterion for that log is based on the log's size and logrotate is being run more than once each day, or unless the-for-- force option is used.

It turns out that this artifact is designed to facilitate the management of a large number of log files, log files can be automatically rotation (literally meaning rotation, think it is better to understand as a log loop), compress, delete and send log files through email. Granularity is well controlled, and rotate can be done daily, weekly, monthly, or when the log file is too large for each log file.

In general, logrotate is based on the daily cron job, so the rotae of a log file is executed once a day, unless the execution standard of rotate is based on the size of the log file, and your logrotate command is executed many times a day, that is, you customize the scheduled task to let logrotate execute every x minutes or every x hours, or you manually execute the command with the option-f/--force.

In addition, I found that this artifact comes with the system, and you can imagine how important this tool is, otherwise Linux would not have installed it by default.

Next, let's take a look at the configuration of logrotate and how to execute logrotate.

The conf file of logrotate is under / etc/:

[root@labhost] # ll / etc/logrotate. Logrotate.conf logrotate.d/ [root@labhost ~] # cat / etc/logrotate.conf

Let's take a look at the contents of the logrotate.conf file:

[root@labhost ~] # cat / etc/logrotate.conf # see "man logrotate" for details # rotate log files weekly: once a week rotate log file weekly # keep 4 weeks worth of backlogs: save the log log for the last 4 weeks, because the above is after the rotate 4 # create new (empty) log files after rotating old ones:rotate old log file rotate once a week The file that creates a new empty log file create # use date as a suffix of the rotated file:rotate is suffixed with the date format, for example: access_log-20200422. If this option is not added, the format of rotate is: access_log.1,access_log.2, etc. Dateext # uncomment this if you want your log files compressed: if you want to compress the file after rotate, just remove the # in front of compress below. # compress # RPM packages drop log rotation information into this directory:RPM package log rotation configuration information, it is recommended to put it in the / etc/logrotate.d folder to implement custom control log file rotate include / etc/logrotate.d # no packages own wtmp and btmp-- we'll rotate them here:wtmp and btmp do not belong to any package Let's write the rules of rotate here / var/log/wtmp {monthly # execute rotate create 0664 root utmp # once a month to create an empty file with permission of 664. the user name belongs to the user group minsize 1m # log file size exceeds 1m before rotate is executed, otherwise skip rotate 1 # rotate Keep only one rotate file} / var/log/btmp {missingok monthly create 0600 root utmp rotate 1} # system-specific logs may be also be configured here.# other system logs can also be configured here for rotate rules

With regard to the configuration of rotate rules, you can see from the logrotate.conf file above that there are two places to configure:

One is to configure it directly in logrotate.conf, but it generally applies to Syslog files that are not RPM packages.

The other is that if you want to do rotate log files are generated by third-party RPM package software, you need to create a new configuration file under the / etc/logrotate.d folder to configure the relevant rotate rules. (UnleBen found that if you install a third-party software package, the rotate configuration file for the corresponding software will be automatically created under the / etc/logrotate.d folder. )

UncleBen has a clean CentOS7 here. Before installing the httpd service, let's take a look at the configuration files under the / etc/logrotate.d folder.

[root@labhost ~] # ll / etc/logrotate.d/ total 20-rw-r--r--. 1 root root 91 Apr 11 2018 bootlog-rw-r--r--. 1 root root 224 Oct 30 2018 syslog-rw-r--r--. 1 root root 100 Oct 31 2018 wpa_supplicant-rw-r--r--. 1 root root 103 Nov 5 2018 yum [root@labhost ~] #

Let's now install the httpd service:

[root@labhost] # yum install httpd-y Resolving Dependencies-- > Running transaction check-- > Package httpd.x86_64 0pur2.4.6-90.el7.centos will be installed-- > Finished Dependency Resolution. Install 1 Package Total download size: 2.7M Installed size: 9.4M Downloading packages: httpd-2.4.6-90.el7.centos.x86_64.rpm | 2.7MB 00:00:04 Running transaction check Running transaction test Transaction test succeeded Running transaction Installing: httpd-2.4.6-90.el7.centos.x86_64 1True 1 Verifying: httpd-2.4.6-90.el7.centos.x86_64 1 Installed: httpd.x86_64 0Rose 2.4.6-90.el7.centos Complete! [root@labhost ~] #

Go to the / etc/logrotate.d folder again and have a look:

[root@labhost ~] # ll / etc/logrotate.d/ total 24-rw-r--r--. 1 root root 91 Apr 11 2018 bootlog-rw-r--r--. 1 root root 194 Aug 6 2019 httpd-rw-r--r--. 1 root root 224 Oct 30 2018 syslog-rw-r--r--. 1 root root 100 Oct 31 2018 wpa_supplicant-rw-r--r--. 1 root root 103 Nov 5 2018 yum [root@labhost ~] #

You can see that after installing httpd, the log rotate configuration file for the httpd service is automatically created. Open it and have a look:

[root@labhost ~] # cat / etc/logrotate.d/httpd / var/log/httpd/*log {missingok notifempty sharedscripts delaycompress postrotate / bin/systemctl reload httpd.service > / dev/null 2 > / dev/null | | true endscript} [root@labhost ~] #

This is a standard logrotate configuration file for third-party software, with a brief explanation:

Format:

The path to the log file (wildcard character * is supported), plus a pair of curly braces {}

The contents of the curly braces are the rule parameters of logrotate and need to be lined separately.

Parameter interpretation:

Missingok: if the log does not exist, no error message is generated

Notifempty: if the log file is empty, do not do rotate, this is mutually exclusive with your ifempty

Sharedscripts: used with prerotate and postrotate, if sharedscripts is enabled, and if used for log files that need to do rotate

Wildcards, then *

The script for prerotate** and postrotate is only executed once. Without sharedscripts, every time you need a log file to do rotate, you will execute the prerotate and postrotate script.

Delaycompress: delay compressing the old log file, first rotate, no compression, wait until the next rotate, the last rotate file will be compressed. This needs to be used with compress, and it doesn't work if used alone.

Scripts that you want to execute after postrotate/endscript:rotate need to be placed between postrotate and endscript, and the two options need to be on separate lines.

In addition to the above parameters, there are the following common parameters:

Daily specifies that the rotate cycle is daily, as well as weekly and monthly. Rotate count specifies the number of rotate log files to keep. If this parameter is not configured, backups are not retained. If 1 is set, one rotate backup is reserved, and 10 is 10 rotate backups. The size size log file is not dumped until it reaches the specified size. The default size unit is bytes, which can be described as kpgmpg. For example, size 10k, 10m, 10G. Compress compresses the logs through gzip and then backs up the logs. Default value of nocompress, no gzip compression processing. When delaycompress is used with compress, the log files of rotate are not compressed until the next time logrotate is executed. Copytruncate backs up and truncates the current log, first copies the original log file and then empties it. Due to a time difference between copy and emptying, partial log data may be lost. After create mode owner group rotate, create a log file for the new file and specify the properties of the new file, for example: create 644 tomcat tomcat mail address sends the log file of rotate to the specified E-mail. Dateext uses the current date as the naming format. If the specified rotate is greater than 1, the file name after the default rotate is: xx.log.1, xx.log.2, xx.log3, if the dateext rule is configured Then the file name after rotate will end with a date: xx.log.2020-04-20 xx.log.2020 xx.log.2020-04-21, xx.log.2020-04-22 dateformat -% Y%m%d%H.%s defines the date format of the file name after rotate, must be used with dateext, check the data, currently only supports:% log% s these parameters (year, month, day) Hours, seconds)

The rules of rotate are configured, but how to implement them? Let's help.

[root@labhost] # logrotate-- help Usage: logrotate [OPTION...]-d,-- debug Don't do anything, just test (implies-v)-f,-- force Force file rotation-m,-- mail=command Command to send mail (instead of `/ bin/mail')-s,-- state=statefile Path of statefile-v -- verbose Display messages during rotation-l,-- log=STRING Log file-- version Display version information Help options:-- help Show this help message-- usage Display brief usage message [root@labhost ~] #

Here we focus on the two options-d and-f:

-d:debug mode, which means rehearsing it first, not really doing it.

-f: mandatory mode, solid implementation.

From the information of our man logrotate above, we can know that: in general, logrotate is executed based on the daily cron job, so the rotae of a log file is executed once a day, unless the execution standard of rotate is based on the size of the log file, and your logrotate command is executed many times a day, that is, you customize the scheduled task to let logrotate execute every x minutes or every x hour. Or you manually execute the command and add the option-f/--force.

Why is it carried out once a day? If we go to / etc/cron.daily/,/etc/cron.weekly/,/etc/cron.monthly/,/etc/cron.hourly/, we can see that there is a logrotate executable script under the / etc/cron.daily/ folder, so we will run once a day!

[root@labhost ~] # ll / etc/cron.daily/ total 8-rwx-. 1 root root 219 Oct 31 2018 logrotate-rwxr-xr-x. 1 root root 618 Oct 30 2018 man-db.cron [root@labhost ~] # ll / etc/cron.weekly/ total 0 [root@labhost ~] # ll / etc/cron.monthly/ total 0 [root@labhost] # ll / etc/cron.hourly/ total 4-rwxr-xr-x. 1 root root 392 Apr 11 2018 0anacron [root@labhost ~] #

Let's take a look at what is written in the logrotate script:

[root@labhost ~] # cat / etc/cron.daily/logrotate #! / bin/sh / usr/sbin/logrotate-s / var/lib/logrotate/logrotate.status / etc/logrotate.conf EXITVALUE=$? If [$EXITVALUE! = 0]; then / usr/bin/logger-t logrotate "ALERT exited abnormally with [$EXITVALUE]" fi exit 0 [root@labhost ~] #

The simple understanding is to execute the logrotate command and specify the status file and the conf file to execute when logrotate is executed: / etc/logrotate.conf. Do you remember that there is a line in this file: include / etc/logrotate.d, that is, when the logrotate.conf file is executed, the configuration file under the / etc/logrotate.d folder is executed as well. The following lines are logger when an execution error occurs.

So, when we execute logrotate, we can simply run: logrotate + confi filename

[root@labhost ~] # logrotate / etc/logrotate.d/httpd

If all goes well, the logrotate command will be executed successfully and the httpd log files will be rotate according to the rules you configured. But if you don't meet your expectations, you need to come to debug. In fact, it is recommended that before putting into the production environment, it is best to use the-d option to test whether the configuration file you write can meet your expectations. Let's take a look at the results of the run with the-d option:

[root@labhost] # logrotate-d / etc/logrotate.d/httpd reading config file / etc/logrotate.d/httpd Allocating hash table for state file, size 15360 B Handling 1 logs rotating pattern: / var/log/httpd/*log 1048576 bytes (no old logs will be kept) empty log files are not rotated Old logs are removed considering log/ var/log/httpd/access_log log does not need rotating (log size is below the 'size' threshold) considering log/ var/log/httpd/error_log log does not need rotating (log size is below the' size' threshold) not running postrotate script, since no logs were rotated [root@labhost ~] #

Now let's sort out the process of httpd, the logrotate:

Httpd, the logrotate configuration file, is executed once a day, because the logrotate script is placed under / etc/cron.daily/ by default, the script executes the logrotate command according to the / etc/logrotate.conf configuration file, and the logrotate configuration file for the httpd service is under / etc/logrotate.d/, which is included in the / etc/logrotate.conf configuration file.

If there is no file ending in log under / var/log/httpd/, the error message will not be logged.

If the log file under / var/log/httpd/ is an empty file, the rotate operation will not be performed.

After the logrotate is executed, the httpd service is reloaded

In most cases, a daily backup of the log is sufficient. But case like the one UncleBen encountered on Monday: within a day, the log log blew up the disk. So how to solve this kind of case with logrotate?

First of all, let's take a look at the demand:

It is necessary to solve the problem that log files grow too fast in one day and burst the disk. So the key words are: within a day-> time, burst disk-> file size

Execution cycle

Logrotate defaults to daily, and our requirements are within one day, so we can have logrotate executed every half day (every 12 hours), every 8 hours, every 4 hours, every 2 hours, or even every hour. This depends on your mood.

File size

How old is it to execute logrotate, which is also determined according to the actual environment. When UncleBen encountered this case, the log skyrocketed to 89G. Here, I set it to rotate if it is more than 1G.

In order to let the guests and gentlemen see the real effect, I have made a little change here. I will say no more and go to demo:

The configuration file changes for httpd logrotate are as follows:

Version1: add one line to the original: rotate 3

[root@labhost ~] # cat / etc/logrotate.d/httpd / var/log/httpd/*log {rotate 3 missingok notifempty sharedscripts delaycompress postrotate / bin/systemctl reload httpd.service > / dev/null 2 > / dev/null | | true endscript} [root@labhost ~] #

Then I'll create a cron job and execute it every minute:

* / 1 * / usr/sbin/logrotate / etc/logrotate.d/httpd

Then create a script that monitors the log file under the httpd folder:

[root@labhost ~] # cat monitorlog.sh #! / bin/bash while: do sleep 2 ls-hl / var/log/httpd/ done

Let's execute monitorlog.sh and take a look at the log file of httpd. Note: here I visited the Apache default site, then manually refreshed the Apache site to generate a point access log, and then stopped refreshing the page.

[root@labhost] #. / monitorlog.sh total 140K-rw-r--r--. 1 root root 79K Apr 24 14:09 access_log-rw-r--r--. 1 root root 12K Apr 24 14:09 error_log total 140K-rw-r--r--. 1 root root 79K Apr 24 14:09 access_log-rw-r--r--. 1 root root 12K Apr 24 14:09 error_log total 96K-rw-r--r--. 1 root root 0 Apr 24 14:10 access_log-rw-r--r--. 1 root root 79K Apr 24 14:09 access_log.1-rw-r--r--. 1 root root 370 Apr 24 14:10 error_log-rw-r--r--. 1 root root 12K Apr 24 14:10 error_log.1 total 96K-rw-r--r--. 1 root root 0 Apr 24 14:10 access_log-rw-r--r--. 1 root root 79K Apr 24 14:09 access_log.1-rw-r--r--. 1 root root 370 Apr 24 14:10 error_log-rw-r--r--. 1 root root 12K Apr 24 14:10 error_log.1...

We can see:

Since I set logrotate to be executed every minute and specify the logrotate profile httpd, the rules we configure will be executed every minute.

/ var/log/httpd/ under this folder:

There are only two files, access_log and error_log.

Apr 24 14: 09:00, the access_log file size is 79K and the error_log file size is 12K.

Stop refreshing the page and wait a minute.

/ var/log/httpd/ under this folder:

Two files have been added: access_log.1 and error_log.1

Apr 24 14: 10:00, the access_log file is emptied with a size of 0, while the error_log is not empty, proving that error information has been generated.

In order to verify whether the parameter notifempty is valid, we do not refresh the page, wait two more minutes, and then look at the results of monitorlog.sh execution:

Access_log is not rotate, because after the first access log file is rotate, no access log is generated, its size is 0, we add the parameter notifempty in the configuration file, which means that if empty, do not do rotate.

Information under the Apr 24 14:13 / var/log/httpd/ folder:

Total 96K-rw-r--r--. 1 root root 0 Apr 24 14:10 access_log-rw-r--r--. 1 root root 79K Apr 24 14:09 access_log.1-rw-r--r--. 1 root root 370 Apr 24 14:13 error_log-rw-r--r--. 1 root root 663 Apr 24 14:13 error_log.1-rw-r--r--. 1 root root 663 Apr 24 14:12 error_log.2-rw-r--r--. 1 root root 663 Apr 24 14:11 error_log.3

The parameter rotate 3:

Always keep 3 rotate files, so let's wait a few more minutes and see what files are in the / var/log/httpd/ folder to verify.

File name after rotate: therefore. The end of the number.

Information under the Apr 24 14:14 / var/log/httpd/ folder:

Total 96K-rw-r--r--. 1 root root 0 Apr 24 14:10 access_log-rw-r--r--. 1 root root 79K Apr 24 14:09 access_log.1-rw-r--r--. 1 root root 370 Apr 24 14:14 error_log-rw-r--r--. 1 root root 663 Apr 24 14:14 error_log.1-rw-r--r--. 1 root root 663 Apr 24 14:13 error_log.2-rw-r--r--. 1 root root 663 Apr 24 14:12 error_log.3

Information under the Apr 24 14:15 / var/log/httpd/ folder:

Total 96K-rw-r--r--. 1 root root 0 Apr 24 14:10 access_log-rw-r--r--. 1 root root 79K Apr 24 14:09 access_log.1-rw-r--r--. 1 root root 370 Apr 24 14:15 error_log-rw-r--r--. 1 root root 663 Apr 24 14:15 error_log.1-rw-r--r--. 1 root root 663 Apr 24 14:14 error_log.2-rw-r--r--. 1 root root 663 Apr 24 14:13 error_log.3

The parameter delaycompress:

Must be used with compress, it is invalid to use alone, you can see that no log files are compressed, and the file sizes before and after rotate are the same.

The script in the parameter postrotate/endscript: / bin/systemctl reload httpd.service > / dev/null 2 > / dev/null | | true endscript

It is after the log log is rotate that you need to re-reload httpd service. What if you don't have this script? Let's go to / etc/logrotate.d/httpd and comment out these three lines. Let's take a look at the results of monitorlog.sh execution:

Total 92K-rw-r--r--. 1 root root 0 Apr 24 14:10 access_log-rw-r--r--. 1 root root 79K Apr 24 14:09 access_log.1-rw-r--r--. 1 root root 370 Apr 24 14:47 error_log.1-rw-r--r--. 1 root root 663 Apr 24 14:47 error_log.2-rw-r--r--. 1 root root 663 Apr 24 14:46 error_log.3

After commenting out the postrotate/endscript script, we found that:

After the error_log file executes rotate, the new error_log is not created.

Let's refresh the page, try to generate a new access log, and find that it can be written normally, with a change in size.

Total 136K-rw-r--r--. 1 root root 38K Apr 24 14:52 access_log-rw-r--r--. 1 root root 79K Apr 24 14:09 access_log.1-rw-r--r--. 1 root root 5.4K Apr 24 14:52 error_log.1-rw-r--r--. 1 root root 663 Apr 24 14:47 error_log.2-rw-r--r--. 1 root root 663 Apr 24 14:46 error_log.3

But when we wait for the file to be rotate, we find that after access_log is rotate, the new access_log file is also not created.

Total 136K-rw-r--r--. 1 root root 38K Apr 24 14:52 access_log.1-rw-r--r--. 1 root root 79K Apr 24 14:09 access_log.2-rw-r--r--. 1 root root 5.4K Apr 24 14:52 error_log.1-rw-r--r--. 1 root root 663 Apr 24 14:47 error_log.2-rw-r--r--. 1 root root 663 Apr 24 14:46 error_log.3

If we continue to try to refresh the page, we will find that both the access_log.1 and error_log.1 log sizes will grow. This shows the role of the postrotate/endscript intermediate script. If there is no script, that is, there is no reload httpd service after the execution of logrotate, then the httpd service will continue to write information to the old log log, and subsequent logrotate commands against / var/log/httpd/*log will not be executed. Why?

The file path in the configuration file says: / var/log/httpd/*log, you are targeting the file name that ends with log.

Now the file names after rotate are all with. At the end of the number.

Total 148K-rw-r--r--. 1 root root 49K Apr 24 15:30 access_log.1-rw-r--r--. 1 root root 79K Apr 24 14:09 access_log.2-rw-r--r--. 1 root root 6.9K Apr 24 15:30 error_log.1-rw-r--r--. 1 root root 663 Apr 24 14:47 error_log.2-rw-r--r--. 1 root root 663 Apr 24 14:46 error_log.3

Do you remember that we have another parameter called copytruncate? let's try to see what it would look like when there is no postrotate/endscript script.

Version2: delete postrotate/endscript scripts and add copytruncate

[root@labhost ~] # cat / etc/logrotate.d/httpd / var/log/httpd/*log {rotate 3 missingok notifempty sharedscripts delaycompress copytruncate}

We stop httpd service first, then delete all access_log and error_log, and finally start httpd service, you can see that the log files for httpd are generated normally.

[root@labhost ~] # systemctl stop httpd [root@labhost ~] # rm-rf / var/log/httpd/* [root@labhost ~] # ll / var/log/httpd/ total 0 [root@labhost ~] # [root@labhost ~] # systemctl start httpd [root@labhost] # ll / var/log/httpd/ total 4-rw-r--r--. 1 root root 0 Apr 24 15:47 access_log-rw-r--r--. 1 root root 812 Apr 24 15:47 error_log [root@labhost ~] #

Next, let's refresh the page, generate some access log and error log, wait a few minutes, and execute mornitorlog.sh to take a look:

Both access_log and error_log can rotate normally.

New access_log and error_log files can be created and can be written to the log log normally.

Total 60K-rw-r--r--. 1 root root 17K Apr 24 15:51 access_log-rw-r--r--. 1 root root 27K Apr 24 15:51 access_log.1-rw-r--r--. 1 root root 2.3K Apr 24 15:51 error_log-rw-r--r--. 1 root root 3.6K Apr 24 15:51 error_log.1-rw-r--r--. 1 root root 812 Apr 24 15:48 error_log.2

So, I prefer the parameter copytruncate to the reload httpd service script I put in the middle of the postrotate/endscript.

Version3: add the dateext parameter based on version2

[root@labhost ~] # cat / etc/logrotate.d/httpd / var/log/httpd/*log {rotate 3 missingok notifempty sharedscripts delaycompress copytruncate dateext}

We try to visit the page, refresh it, and generate some access log and error log. After waiting for a few minutes, we execute monitorlog.sh to take a look, and we can see:

Ended in a date format when it was last used by a rotate log file.

Our cron job dictates that logrotate be executed every minute, but it fails after adding the dateext parameter. So:

If you want logrotate to be executed more than once a day, do not add the dateext parameter.

If you want logrotate to execute more than once a day, and if you want files after rotate to end in a date format, one way is to add the dateformat.% s parameter.

Total 144K-rw-r--r--. 1 root root 30K Apr 24 16:55 access_log-rw-r--r--. 1 root root 9.3K Apr 24 15:56 access_log.1-rw-r--r--. 1 root root 17K Apr 24 15:52 access_log.2-rw-r--r--. 1 root root 26K Apr 24 16:07 access_log-20200424-rw-r--r--. 1 root root 27K Apr 24 15:51 access_log.3-rw-r--r--. 1 root root 4.1K Apr 24 16:55 error_log-rw-r--r--. 1 root root 1.3K Apr 24 15:56 error_log.1-rw-r--r--. 1 root root 2.3K Apr 24 15:52 error_log.2-rw-r--r--. 1 root root 3.6K Apr 24 16:07 error_log-20200424-rw-r--r--. 1 root root 3.6K Apr 24 15:51 error_log.3

Version4: add dateformat -% Y%m%d%H.%s parameter based on version3

[root@labhost ~] # cat / etc/logrotate.d/httpd / var/log/httpd/*log {rotate 3 missingok notifempty sharedscripts delaycompress copytruncate dateext dateformat -% Y%m%d%H.%s}

We try to visit the page again, refresh it, and generate some access log and error log. After waiting for a few minutes, we execute monitorlog.sh to take a look, and we can see:

Our cron job now executes normally, and can be executed multiple times when the log file is not empty and there are updates.

The file after being rotate ends in date format:

-the bar begins, then the year, month, day, and then the period. The last is the seconds, but the last .s% is the number of seconds experienced since 00:00:00 on January 1, 1970.

Total 172K-rw-r--r--. 1 root root 7.5K Apr 24 17:41 access_log-rw-r--r--. 1 root root 26K Apr 24 16:07 access_log-20200424-rw-r--r--. 1 root root 25K Apr 2417: 32 access_log-2020042417.1587720721-rw-r--r--. 1 root root 14K Apr 2417: 39 access_log-2020042417.1587721141-rw-r--r--. 1 root root 3.8K Apr 2417: 40 access_log-2020042417.1587721201-rw-r--r--. 1 root root 1.1K Apr 24 17:41 error_log-rw-r--r--. 1 root root 3.6K Apr 24 16:07 error_log-20200424-rw-r--r--. 1 root root 3.3K Apr 2417: 32 error_log-2020042417.1587720721-rw-r--r--. 1 root root 1.8K Apr 2417: 39 error_log-2020042417.1587721141-rw-r--r--. 1 root root 514 Apr 2417: 40 error_log-2020042417.1587721201

One question for everyone: if the format defined by dateformat is: -% Y%m%d%H, how often will access_log and error_log be rotate if the log file is not empty and constantly updated?

Version5: add size 50K parameter based on version4

[root@labhost ~] # cat / etc/logrotate.d/httpd / var/log/httpd/*log {size 50K rotate 3 missingok notifempty sharedscripts delaycompress copytruncate dateext dateformat -% Y%m%d%H.%s}

This time, we first execute monitorlog.sh to see the size of access_log and error_log, and then try to visit the page, refresh, and generate some access log and error log. Note that because the size size I configured is 50K, let the access_log file size 50K, observe the monitorlog.sh output, and you can find:

Apr 24 18: 12:00

Logrotate is executed once, and because the access_log file size is > 50K, it is rotate. And save it as: access_log-2020042418.1587723121

Since the error_log file size is 50K, if you look at the monitorlog.sh output, you can find:

Apr 24 17: 59

Logrotate is executed once, because the access_log file size is more than 50K, so it is rotate and compressed, saved as: access_log-2020042417.1587722341.gz

The size before being compressed is 7.5K, and after being compressed is 398, less than 1k, so it is highly recommended to add this parameter to save space!

Due to error_log file size

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.