Linux 清除大型 Apache 域日志
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/9569284/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Clearing Large Apache Domain Logs
提问by Harry Andrei
I am having an issue where Apache logs are growing out of proportion on several servers (Linux CentOS 5)... I will eventually disable logging completely but for now I need a quick fix to reclaim the hard disk space.
我遇到了一个问题，即 Apache 日志在多台服务器（Linux CentOS 5）上的增长不成比例……我最终将完全禁用日志记录，但现在我需要一个快速修复来回收硬盘空间。
I have tried using the echo " " > /path/to/log.logor the * > /path/to/log.logbut they take too long and almost crash the server as the logs are as large as 100GB
我曾尝试使用echo " " > /path/to/log.log或 ，* > /path/to/log.log但它们花费的时间太长并且几乎使服务器崩溃，因为日志大到 100GB
Deleting the files works fast but my question is, will it cause a problem when I restart apache. My servers are live and full of users so I can't crash them.
删除文件的速度很快，但我的问题是，当我重新启动 apache 时会不会导致问题。我的服务器是活跃的并且充满了用户，所以我不能让它们崩溃。
Your help is appreciated.
感谢您的帮助。
回答by Kirby Todd
回答by rkosegi
Try this:
尝试这个：
cat /dev/null > /path/to/log.log
回答by TerryE
mv /path/to/log.log /path/to/log.log.1
Do this for your access, error and if you are reallydoing it on prod, you rewrite logs. This doesn't effect Apache on *nix, since the file is open. Then restart Apache. Yes, I know I said restart, but this usually takes a second or so, so I doubt that anyone will notice -- or blame it on the network. The restarted Apache will be running with a new set of log files.
这样做是为了您的访问，错误，如果您真的在生产中这样做，您将重写日志。这不会影响 *nix 上的 Apache，因为文件是打开的。然后重新启动Apache。是的，我知道我说的是重新启动，但这通常需要一秒钟左右的时间，所以我怀疑有人会注意到 - 或者将其归咎于网络。重新启动的 Apache 将使用一组新的日志文件运行。
In terms of your current logs, IMO you need to keep at leastthe last 3 months error logs, and 1 month access logs, but look at your volumetrics to decide your rough per week volumes for error and access logs. Don'ttruncate the old files. If necessary do a nice tail piped to gzip -cof these to archives. If you want to split the use a loop doing a tail|head|gzip using the --bytes=nnGoption. OK, you'll split across the odd line but that's better than deleting the lot as you suggest.
就您当前的日志而言，IMO 您至少需要保留最近 3 个月的错误日志和 1 个月的访问日志，但请查看您的容量来确定每周粗略的错误和访问日志量。 不要截断旧文件。如果有必要，做一个很好的尾部管道gzip -c到档案。如果要拆分使用循环执行 tail|head|gzip 使用--bytes=nnG选项。好的，您将在奇数线上拆分，但这比按照您的建议删除该批次要好。
Of course, you could just delete the lot as you and others propose, but what are you going to do if you've realised that the site has been hacked recently? "Sorry: too late; I've deleted the evidence!"
当然，您可以按照您和其他人的建议删除该批次，但是如果您意识到该站点最近被黑客入侵，您将怎么做？“对不起：太晚了，我已经删除了证据！”
Then for goodness sake implement a logrotate regime.
然后看在上帝的份上，实施一个 logrotate 制度。
