logrotate不压缩/ var / log / messages

随着时间的推移，我注意到一些日志/var/log，例如auth，kern并且messages变得越来越大。我logrotate为他们输入了：

$ cat /etc/logrotate.d/auth.log 
/var/log/kern.log {
    rotate 5
    daily
}
$ cat /etc/logrotate.d/kern.log 
/var/log/kern.log {
    rotate 5
    daily
}
$ cat /etc/logrotate.d/messages 
/var/log/messages {
    rotate 5
    daily
    postrotate
        /bin/killall -HUP syslogd
    endscript
}

我也compress启用了该选项：

$ grep compress /etc/logrotate.conf 
# uncomment this if you want your log files compressed
compress

这个伟大工程auth.log，kern.log和其他人，这意味着每个这些日志被gzip压缩和旋转，用日志的最近5天保留。/var/log/messages但是未压缩，因此导致超过5天的日志记录：

$ ls /var/log/messages*
/var/log/messages           /var/log/messages-20100213
/var/log/messages-20100201  /var/log/messages-20100214
/var/log/messages-20100202  /var/log/messages-20100215
/var/log/messages-20100203  /var/log/messages-20100216
/var/log/messages-20100204  /var/log/messages-20100217
/var/log/messages-20100205  /var/log/messages-20100218
/var/log/messages-20100206  /var/log/messages-20100219
/var/log/messages-20100207  /var/log/messages-20100220
/var/log/messages-20100208  /var/log/messages-20100221
/var/log/messages-20100209  /var/log/messages-20100222
/var/log/messages-20100210  /var/log/messages-20100223
/var/log/messages-20100211  /var/log/messages-20100224
/var/log/messages-20100212

正如有关ServerFault的另一个logrotate问题所解释的那样，（很可能）不会删除旧日志，因为每个文件的文件结尾都不同。这似乎是因为文件没有被压缩。

/var/log/messages像其他所有日志文件一样，如何在保留最近5天日志的情况下进行压缩和旋转？我想念什么？

编辑1：根据前几个答案的要求提供其他信息。

我正在运行Gentoo Linux。我的/etc/logrotate.conf档案：

$ cat /etc/logrotate.conf 
# $Header: /var/cvsroot/gentoo-x86/app-admin/logrotate/files/logrotate.conf,v 1.3 2008/12/24 20:49:10 dang Exp $
#
# Logrotate default configuration file for Gentoo Linux
#
# See "man logrotate" for details
# rotate log files weekly
weekly
#daily
# keep 4 weeks worth of backlogs
rotate 4
# create new (empty) log files after rotating old ones
create
# use date as a suffix of the rotated file
dateext
# uncomment this if you want your log files compressed
compress
# packages can drop log rotation information into this directory
include /etc/logrotate.d
notifempty
nomail
noolddir
# no packages own lastlog or wtmp -- we'll rotate them here
/var/log/wtmp {
    monthly
    create 0664 root utmp
    rotate 1
}
/var/log/btmp {
    missingok
    monthly
    create 0600 root utmp
    rotate 1
}

/etc/logrotate.d 包含上述我的自定义配置文件以及这些软件包安装的mysql，rsync等配置。

我的根crontab是空的：

$ sudo crontab -l
no crontab for root

我检查了所有/etc/cron.{daily,hourly,monthly,weekly}与syslog相关的内容，并且有一个脚本旋转/var/log/syslog和/var/log/auth.log。

接下来，我做了一个/var/log/messages-only logrotate配置文件由CarpeNoctem的建议：

$ cat logrotate-messages 
weekly
rotate 4
create
dateext
compress
notifempty
nomail
noolddir
/var/log/messages {
    rotate 5
    daily
    postrotate
        /bin/killall -HUP syslogd
    endscript
}

然后我logrotate手动运行：

$ logrotate -d logrotate-messages -f
reading config file logrotate-messages
reading config info for /var/log/messages 

Handling 1 logs

rotating pattern: /var/log/messages  forced from command line (5 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/messages
  log needs rotating
rotating log /var/log/messages, log->rotateCount is 5
dateext suffix '-20100224'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
glob finding old rotated logs failed
renaming /var/log/messages to /var/log/messages-20100224
creating new /var/log/messages mode = 0644 uid = 0 gid = 0
running postrotate script
running script with arg /var/log/messages : "
        /bin/killall -HUP syslogd
"
compressing log with: /bin/gzip
$ which gzip
/bin/gzip
$ file /bin/gzip
/bin/gzip: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.9, stripped

根据上面logrotate的日志，使用/ bin / gzip压缩了日志，但是在中没有看到压缩的消息文件/var/log。此外，遍历旧的旋转文件失败。

编辑2：将后缀logrotate添加.gz到旧/var/log/message-*文件后，添加运行的调试输出。

我们首先开始：

$ ls /var/log/messages*
/var/log/messages              /var/log/messages-20100222.gz
/var/log/messages-20100219.gz  /var/log/messages-20100223.gz
/var/log/messages-20100220.gz  /var/log/messages-20100224.gz
/var/log/messages-20100221.gz

然后logrotate使用我们的自定义配置文件运行：

$ logrotate -d logrotate-messages -f
reading config file logrotate-messages
reading config info for /var/log/messages 

Handling 1 logs

rotating pattern: /var/log/messages  forced from command line (5 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/messages
  log needs rotating
rotating log /var/log/messages, log->rotateCount is 5
dateext suffix '-20100224'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
removing /var/log/messages-20100219.gz
removing old log /var/log/messages-20100219.gz
destination /var/log/messages-20100224.gz already exists, skipping rotation

这次，logrotate的glob成功并找到了第六个压缩日志文件，打算删除它。该文件实际上并未删除；我猜那是因为我们在调试模式下运行。

我很好奇是否启用delaycompress选项/var/log/messages会有所帮助。我启用了它，并将在第二天早上检查结果。

添加delaycompress到配置部分以/var/log/messages解决该问题。

来自man logrotate：

   delaycompress
          Postpone  compression of the previous log file to the next rota‐
          tion cycle.  This only has effect when used in combination  with
          compress.   It  can  be used when some program cannot be told to
          close its logfile and thus might continue writing to the  previ‐
          ous log file for some time.

我想sysklogd我的syslog守护程序不能被告知关闭其日志文件，因此这是必要的。

有趣的是，我原来的配置（不带delaycompress指令）直接出来了man logrotate（除了我更改weekly为daily）：

   # sample logrotate configuration file
   compress

   /var/log/messages {
       rotate 5
       weekly
       postrotate
           /usr/bin/killall -HUP syslogd
       endscript
   }

仅凭此信息很难说，但我可以告诉您，有几次让我省了下来。

Logrotate具有调试选项，该选项将逐步输出到stdout的每个步骤。因此，在这种情况下，您可以执行以下操作：

logrotate -d /etc/logrotate.conf

输出将告诉您到底发生了什么。另外，如果您想缩小调试输出范围，则可以执行

logrotate -d /etc/logrotate.d/messages

虽然您可能希望将main logrotate.conf选项临时放置在该文件块中，因为直接指定文件意味着它永远不会读取main configs选项。指定单个文件还意味着您可以将-f（force）选项与debug选项结合使用，以查看消息文件实际发生的旋转情况。

考虑在您的logrotate.conf中尝试此设置：

dateformat .%Y%m%d

并重命名现有的邮件文件以使用点而不是破折号。然后，再次尝试您的logrotate。

下面的线索使我相信，如果将破折号以某种方式解释为一种选择，那么破折号可能会导致其失败（其中-将解决此问题）。这没有任何意义，但可能是可能的。

dateext suffix '-20100224'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
glob finding old rotated logs failed