Centos/Linux 设置 logrotate 到所有日志的最大文件大小

Centos/Linux setting logrotate to maximum file size for all logs

提问by snh_nl

we use logrotate and it runs daily ... now we have had some situations where logs have grown significantly (read: gigbaytes) and killing our server. So now we would like to set a maximum filesize to the logs ....

我们使用 logrotate 并且它每天运行......现在我们遇到了一些日志显着增长（阅读：gigbaytes）并杀死我们的服务器的情况。所以现在我们想为日志设置最大文件大小....

can I just add this to the logrotate.conf?

我可以将它添加到 logrotate.conf 吗？

size 50M

大小 50M

and would it then apply to all log files? Or do I need to set this on a per log basis?

然后它会适用于所有日志文件吗？或者我需要在每个日志的基础上设置它吗？

Or any other advice?

或者有什么其他建议？

(ps. I understand that if you want to be notified is the log grows like described and what we want to do is not ideal - but it is better than not being able to logon anymore because there is no space available)

（ps。我知道如果您想收到通知，日志会像描述的那样增长并且我们想要做的并不理想 - 但总比因为没有可用空间而无法再登录要好）

thanks, Sean

谢谢，肖恩

采纳答案by Zeeshan

It specifies the size of the log fileto trigger rotation. For example size 50Mwill trigger a log rotation once the file is 50MB or greater in size. You can use the suffix Mfor megabytes, kfor kilobytes, and Gfor gigabytes. If no suffix is used, it will take it to mean bytes. You can check the example at the end. There are three directives available size, maxsize, and minsize. According to manpage:

它指定要触发轮换的日志文件的大小。例如，size 50M一旦文件大小为 50MB 或更大，就会触发日志轮换。您可以使用后缀M表示兆字节、k千字节和G千兆字节。如果不使用后缀，则将其视为字节。您可以在最后查看示例。有三个指令可用size，maxsize和minsize。根据手册页：

minsize size
              Log  files  are  rotated when they grow bigger than size bytes,
              but not before the additionally specified time interval (daily,
              weekly,  monthly, or yearly).  The related size option is simi-
              lar except that it is mutually exclusive with the time interval
              options,  and  it causes log files to be rotated without regard
              for the last rotation time.  When minsize  is  used,  both  the
              size and timestamp of a log file are considered.

size size
              Log files are rotated only if they grow bigger then size bytes.
              If size is followed by k, the size is assumed to  be  in  kilo-
              bytes.  If the M is used, the size is in megabytes, and if G is
              used, the size is in gigabytes. So size 100,  size  100k,  size
              100M and size 100G are all valid.
maxsize size
              Log files are rotated when they grow bigger than size bytes even before
              the additionally specified time interval (daily, weekly, monthly, 
              or yearly).  The related size option is  similar  except  that  it 
              is mutually exclusive with the time interval options, and it causes
              log files to be rotated without regard for the last rotation time.  
              When maxsize is used, both the size and timestamp of a log file are                  
              considered.

Here is an example:

下面是一个例子：

"/var/log/httpd/access.log" /var/log/httpd/error.log {
           rotate 5
           mail [email protected]
           size 100k
           sharedscripts
           postrotate
               /usr/bin/killall -HUP httpd
           endscript
       }

Here is an explanation for both files /var/log/httpd/access.logand /var/log/httpd/error.log. They are rotated whenever it grows over 100k in size, and the old logs files are mailed (uncompressed) to [email protected]after going through 5 rotations, rather than being removed. The sharedscriptsmeans that the postrotatescript will only be run once (after the old logs have been compressed), not once for each log which is rotated. Note that the double quotes around the first filename at the beginning of this section allows logrotate to rotate logs with spaces in the name. Normal shell quoting rules apply, with ,, and \characters supported.

这是文件/var/log/httpd/access.log和/var/log/httpd/error.log. 它们在大小超过 100k 时被轮换，并且旧的日志文件[email protected]在经过 5 轮轮换后被邮寄（未压缩），而不是被删除。这sharedscripts意味着postrotate脚本只会运行一次（在旧日志被压缩之后），而不是每个轮换的日志都运行一次。请注意，本节开头的第一个文件名周围的双引号允许 logrotate 旋转名称中带有空格的日志。正常的 shell 引用规则适用，支持,、 和\字符。

回答by Matt

As mentioned by Zeeshan, the logrotate options size, minsize, maxsizeare triggers for rotation.

正如Zeeshan的logrotate的选项中提到size，minsize，maxsize是旋转的触发器。

To better explain it. You can run logrotate as often as you like, but unless a threshold is reached such as the filesize being reached or the appropriate time passed, the logs will not be rotated.

为了更好地解释它。您可以随心所欲地运行 logrotate，但除非达到阈值，例如达到文件大小或经过适当的时间，否则日志不会被轮换。

The size options do not ensure that your rotated logs are also of the specified size. To get them to be close to the specified size you need to call the logrotate program sufficiently often. This is critical.

大小选项不能确保您的轮换日志也具有指定的大小。为了让它们接近指定的大小，您需要足够频繁地调用 logrotate 程序。这很关键。

For log files that build up very quickly (e.g. in the hundreds of MB a day), unless you want them to be very large you will need to ensure logrotate is called often! this is critical.

对于快速建立的日志文件（例如每天数百 MB），除非您希望它们非常大，否则您需要确保经常调用 logrotate！这很关键。

Therefore to stop your disk filling up with multi-gigabyte log files you need to ensure logrotate is called often enough, otherwise the log rotation will not work as well as you want.

因此，要阻止磁盘填满数 GB 的日志文件，您需要确保足够频繁地调用 logrotate，否则日志轮换将无法如您所愿。

on Ubuntu, you can easily switch to hourly rotation by moving the script /etc/cron.daily/logrotate to /etc/cron.hourly/logrotate

在 Ubuntu 上，您可以通过将脚本 /etc/cron.daily/logrotate 移动到 /etc/cron.hourly/logrotate 来轻松切换到每小时轮换

Or add

或添加

*/5 * * * * /etc/cron.daily/logrotate 

To your /etc/crontab file. To run it every 5 minutes.

到您的 /etc/crontab 文件。每 5 分钟运行一次。

The sizeoption ignores the daily, weekly, monthly time options. But minsize & maxsize take it into account.

该size选项忽略每日、每周、每月时间选项。但是 minsize 和 maxsize 将其考虑在内。

The man page is a little confusing there. Here's my explanation.

那里的手册页有点混乱。这是我的解释。

minsizerotates only when the file has reached an appropriate size and the set time period has passed.e.g. minsize 50MB + daily If file reaches 50MB before daily time ticked over, it'll keep growing until the next day.

minsize仅当文件达到适当的大小并且设置的时间段已过时才会旋转。例如 minsize 50MB + daily 如果文件在每日时间结束前达到 50MB，它会一直增长到第二天。

maxsizewill rotate when the log reaches a set size or the appropriate time has passed.e.g. maxsize 50MB + daily. If file is 50MB and we're not at the next day yet, the log will be rotated. If the file is only 20MB and we roll over to the next day then the file will be rotated.

maxsize当日志达到设定的大小或经过适当的时间时，将旋转。例如 maxsize 50MB + 每天。如果文件是 50MB 并且我们还没有到第二天，日志将被轮换。如果文件只有 20MB 并且我们滚动到第二天，那么文件将被轮换。

sizewill rotate when the log > size. Regardless of whether hourly/daily/weekly/monthly is specified.So if you have size 100M - it means when your log file is > 100M the log will be rotated if logrotate is run when this condition is true. Once it's rotated, the main log will be 0, and a subsequent run will do nothing.

size将在日志 > 大小时旋转。无论是否指定每小时/每天/每周/每月。因此，如果您的大小为 100M - 这意味着当您的日志文件大于 100M 时，如果在此条件为真时运行 logrotate，则日志将被旋转。一旦旋转，主日志将为 0，后续运行将不执行任何操作。

So in the op's case. Specficially 50MB max I'd use something like the following:

所以在op的情况下。特别是最大 50MB 我会使用如下内容：

/var/log/logpath/*.log {
    maxsize 50M
    hourly
    missingok
    rotate 8
    compress
    notifempty
    nocreate
}

Which means he'd create 8hrs of logs max. And there would be 8 of them at no more than 50MB each. Since he's saying that he's getting multi gigabytes each day and assuming they build up at a fairly constant rate, and maxsize is used he'll end up with around close to the max reached for each file. So they will be likely close to 50MB each. Given the volume they build, he would need to ensure that logrotate is run often enough to meet the target size.

这意味着他最多可以创建 8 小时的日志。其中将有 8 个，每个不超过 50MB。由于他说他每天获得数 GB 的数据并假设它们以相当恒定的速率建立，并且使用了 maxsize，因此他最终会接近每个文件达到的最大值。因此，它们每个可能接近 50MB。鉴于他们构建的卷，他需要确保 logrotate 运行的频率足以满足目标大小。

Since I've put hourly there, we'd need logrotate to be run a minimum of every hour. But since they build up to say 2 gigabytes per day and we want 50MB... assuming a constant rate that's 83MB per hour. So you can imagine if we run logrotate every hour, despite setting maxsize to 50 we'll end up with 83MB log's in that case. So in this instance set the running to every 30 minutes or less should be sufficient.

由于我每小时都在那里，我们需要 logrotate 至少每小时运行一次。但由于他们每天累积 2 GB 数据，而我们想要 50MB……假设恒定速率为每小时 83MB。所以你可以想象，如果我们每小时运行一次 logrotate，尽管将 maxsize 设置为 50，在这种情况下我们最终会得到 83MB 的日志。因此，在这种情况下，将运行设置为每 30 分钟或更短时间就足够了。

Ensure logrotate is run every 30 mins.

确保 logrotate 每 30 分钟运行一次。

*/30 * * * * /etc/cron.daily/logrotate