linux - 在树莓派上使用logrotate和syslog-ng(如何删除旧日志？)

Question

好的..

我使用我的树莓派作为 Cisco ASA 和 Cisco 路由器的系统日志服务器。

我已将日志填充到我的/var/log/network 目标位置。目前，它们的记录格式为:_$MONTH$DAY$YEAR.log，使用 ROUTER 或 FIREWALL 作为设备。

到目前为止，效果很好!我每天都会收到路由器和防火墙的详细日志。问题是我收到的日志非常大...由于 ASA，速度非常快。

我是 logrotate 新手..所以这就是我到目前为止所拥有的:

在我的/etc/logrotate.d/syslog-ng 目录中...

    /var/log/network/*.log*
   { 
    rotate 5
   }

对于 logrotate.conf 文件中的全局选项:

admin@kylespi:/etc$ more logrotate.conf
# see "man logrotate" for details
# rotate log files weekly
weekly

# keep 4 weeks worth of backlogs
rotate 4

# create new (empty) log files after rotating old ones
create

# uncomment this if you want your log files compressed
#compress

# packages drop log rotation information into this directory
include /etc/logrotate.d

# no packages own wtmp, or btmp -- we'll rotate them here
/var/log/wtmp {
missingok
monthly
create 0664 root utmp
rotate 1
}

/var/log/btmp {
missingok
monthly
create 0660 root utmp
rotate 1
}

现在...如果我尝试强制 logrotate 运行:

sudo logrotate /etc/logrotate.d -v

而不是删除超过 5 天的文件(基于rotate 5 命令)..我得到这个:

admin@kylespi:/etc$ sudo ls /var/log/network
FIREWALL_03052014.log              FIREWALL_03072014.log                  FIREWALL_03092014.log.1.1.1.1.1.1  FIREWALL_03122014.log.1.1.1.1.1.1
FIREWALL_03052014.log.1.1.1.1.1.1  FIREWALL_03072014.log.1.1.1.1.1.1      FIREWALL_03102014.log.1.1.1.1.1.1  ROUTER_03082014.log
FIREWALL_03062014.log              FIREWALL_03082014.log                  FIREWALL_03112014.log.1.1.1.1.1.1

FIREWALL_03062014.log.1.1.1.1.1.1 FIREWALL_03082014.log.1.1.1.1.1.1 FIREWALL_03122014.log

如果有帮助，“logrotate/etc/logrotate.d -v”命令的输出如下:

admin@kylespi:/etc/logrotate.d$ sudo logrotate /etc/logrotate.d/syslog-ng -v
[sudo] password for admin: 
reading config file /etc/logrotate.d/syslog-ng

Handling 1 logs

rotating pattern: /var/log/network/*.log*
 1048576 bytes (5 rotations)
empty log files are rotated, old logs are removed
considering log /var/log/network/FIREWALL_03052014.log
  log does not need rotating
considering log /var/log/network/FIREWALL_03052014.log.1.1.1.1.1
  log needs rotating
considering log /var/log/network/FIREWALL_03062014.log
  log does not need rotating
considering log /var/log/network/FIREWALL_03062014.log.1.1.1.1.1
  log needs rotating
considering log /var/log/network/FIREWALL_03072014.log
  log does not need rotating
considering log /var/log/network/FIREWALL_03072014.log.1.1.1.1.1
  log needs rotating
considering log /var/log/network/FIREWALL_03082014.log
  log does not need rotating
considering log /var/log/network/FIREWALL_03082014.log.1.1.1.1.1
  log needs rotating
considering log /var/log/network/FIREWALL_03092014.log.1.1.1.1.1
  log needs rotating
considering log /var/log/network/FIREWALL_03102014.log.1.1.1.1.1
  log needs rotating
considering log /var/log/network/FIREWALL_03112014.log.1.1.1.1.1
  log needs rotating
considering log /var/log/network/FIREWALL_03122014.log
  log does not need rotating
considering log /var/log/network/FIREWALL_03122014.log.1.1.1.1.1
  log needs rotating
considering log /var/log/network/ROUTER_03082014.log
  log does not need rotating
rotating log /var/log/network/FIREWALL_03052014.log.1.1.1.1.1, log->rotateCount is 5
dateext suffix '-20140312'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
renaming /var/log/network/FIREWALL_03052014.log.1.1.1.1.1.5 to /var/log/network/FIREWALL_03052014.log.1.1.1.1.1.6 (rotatecount 5, logstart 1, i 5), 
old log /var/log/network/FIREWALL_03052014.log.1.1.1.1.1.5 does not exist
renaming /var/log/network/FIREWALL_03052014.log.1.1.1.1.1.4 to /var/log/network/FIREWALL_03052014.log.1.1.1.1.1.5 (rotatecount 5, logstart 1, i 4), 
old log /var/log/network/FIREWALL_03052014.log.1.1.1.1.1.4 does not exist
renaming /var/log/network/FIREWALL_03052014.log.1.1.1.1.1.3 to /var/log/network/FIREWALL_03052014.log.1.1.1.1.1.4 (rotatecount 5, logstart 1, i 3), 
old log /var/log/network/FIREWALL_03052014.log.1.1.1.1.1.3 does not exist
renaming /var/log/network/FIREWALL_03052014.log.1.1.1.1.1.2 to /var/log/network/FIREWALL_03052014.log.1.1.1.1.1.3 (rotatecount 5, logstart 1, i 2), 
old log /var/log/network/FIREWALL_03052014.log.1.1.1.1.1.2 does not exist
renaming /var/log/network/FIREWALL_03052014.log.1.1.1.1.1.1 to /var/log/network/FIREWALL_03052014.log.1.1.1.1.1.2 (rotatecount 5, logstart 1, i 1), 
old log /var/log/network/FIREWALL_03052014.log.1.1.1.1.1.1 does not exist
renaming /var/log/network/FIREWALL_03052014.log.1.1.1.1.1.0 to /var/log/network/FIREWALL_03052014.log.1.1.1.1.1.1 (rotatecount 5, logstart 1, i 0), 
old log /var/log/network/FIREWALL_03052014.log.1.1.1.1.1.0 does not exist
log /var/log/network/FIREWALL_03052014.log.1.1.1.1.1.6 doesn't exist -- won't try to dispose of it
renaming /var/log/network/FIREWALL_03052014.log.1.1.1.1.1 to /var/log/network/FIREWALL_03052014.log.1.1.1.1.1.1
rotating log /var/log/network/FIREWALL_03062014.log.1.1.1.1.1, log->rotateCount is 5
dateext suffix '-20140312'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
renaming /var/log/network/FIREWALL_03062014.log.1.1.1.1.1.5 to /var/log/network/FIREWALL_03062014.log.1.1.1.1.1.6 (rotatecount 5, logstart 1, i 5), 
old log /var/log/network/FIREWALL_03062014.log.1.1.1.1.1.5 does not exist
renaming /var/log/network/FIREWALL_03062014.log.1.1.1.1.1.4 to /var/log/network/FIREWALL_03062014.log.1.1.1.1.1.5 (rotatecount 5, logstart 1, i 4), 
old log /var/log/network/FIREWALL_03062014.log.1.1.1.1.1.4 does not exist
renaming /var/log/network/FIREWALL_03062014.log.1.1.1.1.1.3 to /var/log/network/FIREWALL_03062014.log.1.1.1.1.1.4 (rotatecount 5, logstart 1, i 3), 
old log /var/log/network/FIREWALL_03062014.log.1.1.1.1.1.3 does not exist
renaming /var/log/network/FIREWALL_03062014.log.1.1.1.1.1.2 to /var/log/network/FIREWALL_03062014.log.1.1.1.1.1.3 (rotatecount 5, logstart 1, i 2), 
old log /var/log/network/FIREWALL_03062014.log.1.1.1.1.1.2 does not exist
renaming /var/log/network/FIREWALL_03062014.log.1.1.1.1.1.1 to /var/log/network/FIREWALL_03062014.log.1.1.1.1.1.2 (rotatecount 5, logstart 1, i 1), 
old log /var/log/network/FIREWALL_03062014.log.1.1.1.1.1.1 does not exist
renaming /var/log/network/FIREWALL_03062014.log.1.1.1.1.1.0 to /var/log/network/FIREWALL_03062014.log.1.1.1.1.1.1 (rotatecount 5, logstart 1, i 0), 
old log /var/log/network/FIREWALL_03062014.log.1.1.1.1.1.0 does not exist
log /var/log/network/FIREWALL_03062014.log.1.1.1.1.1.6 doesn't exist -- won't try to dispose of it
renaming /var/log/network/FIREWALL_03062014.log.1.1.1.1.1 to /var/log/network/FIREWALL_03062014.log.1.1.1.1.1.1
rotating log /var/log/network/FIREWALL_03072014.log.1.1.1.1.1, log->rotateCount is 5
dateext suffix '-20140312'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
renaming /var/log/network/FIREWALL_03072014.log.1.1.1.1.1.5 to /var/log/network/FIREWALL_03072014.log.1.1.1.1.1.6 (rotatecount 5, logstart 1, i 5), 
old log /var/log/network/FIREWALL_03072014.log.1.1.1.1.1.5 does not exist
renaming /var/log/network/FIREWALL_03072014.log.1.1.1.1.1.4 to /var/log/network/FIREWALL_03072014.log.1.1.1.1.1.5 (rotatecount 5, logstart 1, i 4), 
old log /var/log/network/FIREWALL_03072014.log.1.1.1.1.1.4 does not exist
renaming /var/log/network/FIREWALL_03072014.log.1.1.1.1.1.3 to /var/log/network/FIREWALL_03072014.log.1.1.1.1.1.4 (rotatecount 5, logstart 1, i 3), 
old log /var/log/network/FIREWALL_03072014.log.1.1.1.1.1.3 does not exist
renaming /var/log/network/FIREWALL_03072014.log.1.1.1.1.1.2 to /var/log/network/FIREWALL_03072014.log.1.1.1.1.1.3 (rotatecount 5, logstart 1, i 2), 
old log /var/log/network/FIREWALL_03072014.log.1.1.1.1.1.2 does not exist
renaming /var/log/network/FIREWALL_03072014.log.1.1.1.1.1.1 to /var/log/network/FIREWALL_03072014.log.1.1.1.1.1.2 (rotatecount 5, logstart 1, i 1), 
old log /var/log/network/FIREWALL_03072014.log.1.1.1.1.1.1 does not exist
renaming /var/log/network/FIREWALL_03072014.log.1.1.1.1.1.0 to /var/log/network/FIREWALL_03072014.log.1.1.1.1.1.1 (rotatecount 5, logstart 1, i 0), 
old log /var/log/network/FIREWALL_03072014.log.1.1.1.1.1.0 does not exist
log /var/log/network/FIREWALL_03072014.log.1.1.1.1.1.6 doesn't exist -- won't try to dispose of it
renaming /var/log/network/FIREWALL_03072014.log.1.1.1.1.1 to /var/log/network/FIREWALL_03072014.log.1.1.1.1.1.1
rotating log /var/log/network/FIREWALL_03082014.log.1.1.1.1.1, log->rotateCount is 5
dateext suffix '-20140312'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
renaming /var/log/network/FIREWALL_03082014.log.1.1.1.1.1.5 to /var/log/network/FIREWALL_03082014.log.1.1.1.1.1.6 (rotatecount 5, logstart 1, i 5), 
old log /var/log/network/FIREWALL_03082014.log.1.1.1.1.1.5 does not exist
renaming /var/log/network/FIREWALL_03082014.log.1.1.1.1.1.4 to /var/log/network/FIREWALL_03082014.log.1.1.1.1.1.5 (rotatecount 5, logstart 1, i 4), 
old log /var/log/network/FIREWALL_03082014.log.1.1.1.1.1.4 does not exist
renaming /var/log/network/FIREWALL_03082014.log.1.1.1.1.1.3 to /var/log/network/FIREWALL_03082014.log.1.1.1.1.1.4 (rotatecount 5, logstart 1, i 3), 
old log /var/log/network/FIREWALL_03082014.log.1.1.1.1.1.3 does not exist
renaming /var/log/network/FIREWALL_03082014.log.1.1.1.1.1.2 to /var/log/network/FIREWALL_03082014.log.1.1.1.1.1.3 (rotatecount 5, logstart 1, i 2), 
old log /var/log/network/FIREWALL_03082014.log.1.1.1.1.1.2 does not exist
renaming /var/log/network/FIREWALL_03082014.log.1.1.1.1.1.1 to /var/log/network/FIREWALL_03082014.log.1.1.1.1.1.2 (rotatecount 5, logstart 1, i 1), 
old log /var/log/network/FIREWALL_03082014.log.1.1.1.1.1.1 does not exist
renaming /var/log/network/FIREWALL_03082014.log.1.1.1.1.1.0 to /var/log/network/FIREWALL_03082014.log.1.1.1.1.1.1 (rotatecount 5, logstart 1, i 0), 
old log /var/log/network/FIREWALL_03082014.log.1.1.1.1.1.0 does not exist
log /var/log/network/FIREWALL_03082014.log.1.1.1.1.1.6 doesn't exist -- won't try to dispose of it
renaming /var/log/network/FIREWALL_03082014.log.1.1.1.1.1 to /var/log/network/FIREWALL_03082014.log.1.1.1.1.1.1
rotating log /var/log/network/FIREWALL_03092014.log.1.1.1.1.1, log->rotateCount is 5
dateext suffix '-20140312'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
renaming /var/log/network/FIREWALL_03092014.log.1.1.1.1.1.5 to /var/log/network/FIREWALL_03092014.log.1.1.1.1.1.6 (rotatecount 5, logstart 1, i 5), 
old log /var/log/network/FIREWALL_03092014.log.1.1.1.1.1.5 does not exist
renaming /var/log/network/FIREWALL_03092014.log.1.1.1.1.1.4 to /var/log/network/FIREWALL_03092014.log.1.1.1.1.1.5 (rotatecount 5, logstart 1, i 4), 
old log /var/log/network/FIREWALL_03092014.log.1.1.1.1.1.4 does not exist
renaming /var/log/network/FIREWALL_03092014.log.1.1.1.1.1.3 to /var/log/network/FIREWALL_03092014.log.1.1.1.1.1.4 (rotatecount 5, logstart 1, i 3), 
old log /var/log/network/FIREWALL_03092014.log.1.1.1.1.1.3 does not exist
renaming /var/log/network/FIREWALL_03092014.log.1.1.1.1.1.2 to /var/log/network/FIREWALL_03092014.log.1.1.1.1.1.3 (rotatecount 5, logstart 1, i 2), 
old log /var/log/network/FIREWALL_03092014.log.1.1.1.1.1.2 does not exist
renaming /var/log/network/FIREWALL_03092014.log.1.1.1.1.1.1 to /var/log/network/FIREWALL_03092014.log.1.1.1.1.1.2 (rotatecount 5, logstart 1, i 1), 
old log /var/log/network/FIREWALL_03092014.log.1.1.1.1.1.1 does not exist
renaming /var/log/network/FIREWALL_03092014.log.1.1.1.1.1.0 to /var/log/network/FIREWALL_03092014.log.1.1.1.1.1.1 (rotatecount 5, logstart 1, i 0), 
old log /var/log/network/FIREWALL_03092014.log.1.1.1.1.1.0 does not exist
log /var/log/network/FIREWALL_03092014.log.1.1.1.1.1.6 doesn't exist -- won't try to dispose of it
renaming /var/log/network/FIREWALL_03092014.log.1.1.1.1.1 to /var/log/network/FIREWALL_03092014.log.1.1.1.1.1.1
rotating log /var/log/network/FIREWALL_03102014.log.1.1.1.1.1, log->rotateCount is 5
dateext suffix '-20140312'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
renaming /var/log/network/FIREWALL_03102014.log.1.1.1.1.1.5 to /var/log/network/FIREWALL_03102014.log.1.1.1.1.1.6 (rotatecount 5, logstart 1, i 5), 
old log /var/log/network/FIREWALL_03102014.log.1.1.1.1.1.5 does not exist
renaming /var/log/network/FIREWALL_03102014.log.1.1.1.1.1.4 to /var/log/network/FIREWALL_03102014.log.1.1.1.1.1.5 (rotatecount 5, logstart 1, i 4), 
old log /var/log/network/FIREWALL_03102014.log.1.1.1.1.1.4 does not exist
renaming /var/log/network/FIREWALL_03102014.log.1.1.1.1.1.3 to /var/log/network/FIREWALL_03102014.log.1.1.1.1.1.4 (rotatecount 5, logstart 1, i 3), 
old log /var/log/network/FIREWALL_03102014.log.1.1.1.1.1.3 does not exist
renaming /var/log/network/FIREWALL_03102014.log.1.1.1.1.1.2 to /var/log/network/FIREWALL_03102014.log.1.1.1.1.1.3 (rotatecount 5, logstart 1, i 2), 
old log /var/log/network/FIREWALL_03102014.log.1.1.1.1.1.2 does not exist
renaming /var/log/network/FIREWALL_03102014.log.1.1.1.1.1.1 to /var/log/network/FIREWALL_03102014.log.1.1.1.1.1.2 (rotatecount 5, logstart 1, i 1), 
old log /var/log/network/FIREWALL_03102014.log.1.1.1.1.1.1 does not exist
renaming /var/log/network/FIREWALL_03102014.log.1.1.1.1.1.0 to /var/log/network/FIREWALL_03102014.log.1.1.1.1.1.1 (rotatecount 5, logstart 1, i 0), 
old log /var/log/network/FIREWALL_03102014.log.1.1.1.1.1.0 does not exist
log /var/log/network/FIREWALL_03102014.log.1.1.1.1.1.6 doesn't exist -- won't try to dispose of it
renaming /var/log/network/FIREWALL_03102014.log.1.1.1.1.1 to /var/log/network/FIREWALL_03102014.log.1.1.1.1.1.1
rotating log /var/log/network/FIREWALL_03112014.log.1.1.1.1.1, log->rotateCount is 5
dateext suffix '-20140312'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
renaming /var/log/network/FIREWALL_03112014.log.1.1.1.1.1.5 to /var/log/network/FIREWALL_03112014.log.1.1.1.1.1.6 (rotatecount 5, logstart 1, i 5), 
old log /var/log/network/FIREWALL_03112014.log.1.1.1.1.1.5 does not exist
renaming /var/log/network/FIREWALL_03112014.log.1.1.1.1.1.4 to /var/log/network/FIREWALL_03112014.log.1.1.1.1.1.5 (rotatecount 5, logstart 1, i 4), 
old log /var/log/network/FIREWALL_03112014.log.1.1.1.1.1.4 does not exist
renaming /var/log/network/FIREWALL_03112014.log.1.1.1.1.1.3 to /var/log/network/FIREWALL_03112014.log.1.1.1.1.1.4 (rotatecount 5, logstart 1, i 3), 
old log /var/log/network/FIREWALL_03112014.log.1.1.1.1.1.3 does not exist
renaming /var/log/network/FIREWALL_03112014.log.1.1.1.1.1.2 to /var/log/network/FIREWALL_03112014.log.1.1.1.1.1.3 (rotatecount 5, logstart 1, i 2), 
old log /var/log/network/FIREWALL_03112014.log.1.1.1.1.1.2 does not exist
renaming /var/log/network/FIREWALL_03112014.log.1.1.1.1.1.1 to /var/log/network/FIREWALL_03112014.log.1.1.1.1.1.2 (rotatecount 5, logstart 1, i 1), 
old log /var/log/network/FIREWALL_03112014.log.1.1.1.1.1.1 does not exist
renaming /var/log/network/FIREWALL_03112014.log.1.1.1.1.1.0 to /var/log/network/FIREWALL_03112014.log.1.1.1.1.1.1 (rotatecount 5, logstart 1, i 0), 
old log /var/log/network/FIREWALL_03112014.log.1.1.1.1.1.0 does not exist
log /var/log/network/FIREWALL_03112014.log.1.1.1.1.1.6 doesn't exist -- won't try to dispose of it
renaming /var/log/network/FIREWALL_03112014.log.1.1.1.1.1 to /var/log/network/FIREWALL_03112014.log.1.1.1.1.1.1
rotating log /var/log/network/FIREWALL_03122014.log.1.1.1.1.1, log->rotateCount is 5
dateext suffix '-20140312'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
renaming /var/log/network/FIREWALL_03122014.log.1.1.1.1.1.5 to /var/log/network/FIREWALL_03122014.log.1.1.1.1.1.6 (rotatecount 5, logstart 1, i 5), 
old log /var/log/network/FIREWALL_03122014.log.1.1.1.1.1.5 does not exist
renaming /var/log/network/FIREWALL_03122014.log.1.1.1.1.1.4 to /var/log/network/FIREWALL_03122014.log.1.1.1.1.1.5 (rotatecount 5, logstart 1, i 4), 
old log /var/log/network/FIREWALL_03122014.log.1.1.1.1.1.4 does not exist
renaming /var/log/network/FIREWALL_03122014.log.1.1.1.1.1.3 to /var/log/network/FIREWALL_03122014.log.1.1.1.1.1.4 (rotatecount 5, logstart 1, i 3), 
old log /var/log/network/FIREWALL_03122014.log.1.1.1.1.1.3 does not exist
renaming /var/log/network/FIREWALL_03122014.log.1.1.1.1.1.2 to /var/log/network/FIREWALL_03122014.log.1.1.1.1.1.3 (rotatecount 5, logstart 1, i 2), 
old log /var/log/network/FIREWALL_03122014.log.1.1.1.1.1.2 does not exist
renaming /var/log/network/FIREWALL_03122014.log.1.1.1.1.1.1 to /var/log/network/FIREWALL_03122014.log.1.1.1.1.1.2 (rotatecount 5, logstart 1, i 1), 
old log /var/log/network/FIREWALL_03122014.log.1.1.1.1.1.1 does not exist
renaming /var/log/network/FIREWALL_03122014.log.1.1.1.1.1.0 to /var/log/network/FIREWALL_03122014.log.1.1.1.1.1.1 (rotatecount 5, logstart 1, i 0), 
old log /var/log/network/FIREWALL_03122014.log.1.1.1.1.1.0 does not exist
log /var/log/network/FIREWALL_03122014.log.1.1.1.1.1.6 doesn't exist -- won't try to dispose of it
renaming /var/log/network/FIREWALL_03122014.log.1.1.1.1.1 to /var/log/network/FIREWALL_03122014.log.1.1.1.1.1.1

Answer 1

尝试删除结尾的星号:

来自

/var/log/network/*.log*

至

/var/log/network/*.log