Ok..
Я использую свой raspberry pi в качестве сервера системного журнала для Cisco ASA и маршрутизатора Cisco.
У меня есть журналы, заполняемые в мой пункт назначения /var/log/network. В настоящее время они регистрируются в формате: _$MONTH$DAY$YEAR.log, с ROUTER или FIREWALL в качестве устройства.
Пока работает отлично! Я получаю журналы с разбивкой по дням как для моего маршрутизатора, так и для моего брандмауэра. Проблема в том, что я получаю довольно большие журналы... довольно быстро из-за ASA.
Я новичок в logrotate .. так что это то, что у меня есть до сих пор:
В моем каталоге /etc/logrotate.d/syslog-ng...
/var/log/network/*.log*
{
rotate 5
}
Для глобальных параметров в файле logrotate.conf:
admin@kylespi:/etc$ more logrotate.conf
# see "man logrotate" for details
# rotate log files weekly
weekly
# keep 4 weeks worth of backlogs
rotate 4
# create new (empty) log files after rotating old ones
create
# uncomment this if you want your log files compressed
#compress
# packages drop log rotation information into this directory
include /etc/logrotate.d
# no packages own wtmp, or btmp -- we'll rotate them here
/var/log/wtmp {
missingok
monthly
create 0664 root utmp
rotate 1
}
/var/log/btmp {
missingok
monthly
create 0660 root utmp
rotate 1
}
Теперь... если я попытаюсь запустить logrotate:
sudo logrotate /etc/logrotate.d -v
Вместо удаления файлов старше 5 дней (на основе команды rotate 5) я получаю следующее:
admin@kylespi:/etc$ sudo ls /var/log/network
FIREWALL_03052014.log FIREWALL_03072014.log FIREWALL_03092014.log.1.1.1.1.1.1 FIREWALL_03122014.log.1.1.1.1.1.1
FIREWALL_03052014.log.1.1.1.1.1.1 FIREWALL_03072014.log.1.1.1.1.1.1 FIREWALL_03102014.log.1.1.1.1.1.1 ROUTER_03082014.log
FIREWALL_03062014.log FIREWALL_03082014.log FIREWALL_03112014.log.1.1.1.1.1.1
FIREWALL_03062014.log.1.1.1.1.1.1 FIREWALL_03082014.log.1.1.1.1.1.1 FIREWALL_03122014.log
Если это поможет, вывод команды «logrotate /etc/logrotate.d -v» говорит следующее:
admin@kylespi:/etc/logrotate.d$ sudo logrotate /etc/logrotate.d/syslog-ng -v
[sudo] password for admin:
reading config file /etc/logrotate.d/syslog-ng
Handling 1 logs
rotating pattern: /var/log/network/*.log*
1048576 bytes (5 rotations)
empty log files are rotated, old logs are removed
considering log /var/log/network/FIREWALL_03052014.log
log does not need rotating
considering log /var/log/network/FIREWALL_03052014.log.1.1.1.1.1
log needs rotating
considering log /var/log/network/FIREWALL_03062014.log
log does not need rotating
considering log /var/log/network/FIREWALL_03062014.log.1.1.1.1.1
log needs rotating
considering log /var/log/network/FIREWALL_03072014.log
log does not need rotating
considering log /var/log/network/FIREWALL_03072014.log.1.1.1.1.1
log needs rotating
considering log /var/log/network/FIREWALL_03082014.log
log does not need rotating
considering log /var/log/network/FIREWALL_03082014.log.1.1.1.1.1
log needs rotating
considering log /var/log/network/FIREWALL_03092014.log.1.1.1.1.1
log needs rotating
considering log /var/log/network/FIREWALL_03102014.log.1.1.1.1.1
log needs rotating
considering log /var/log/network/FIREWALL_03112014.log.1.1.1.1.1
log needs rotating
considering log /var/log/network/FIREWALL_03122014.log
log does not need rotating
considering log /var/log/network/FIREWALL_03122014.log.1.1.1.1.1
log needs rotating
considering log /var/log/network/ROUTER_03082014.log
log does not need rotating
rotating log /var/log/network/FIREWALL_03052014.log.1.1.1.1.1, log->rotateCount is 5
dateext suffix '-20140312'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
renaming /var/log/network/FIREWALL_03052014.log.1.1.1.1.1.5 to /var/log/network/FIREWALL_03052014.log.1.1.1.1.1.6 (rotatecount 5, logstart 1, i 5),
old log /var/log/network/FIREWALL_03052014.log.1.1.1.1.1.5 does not exist
renaming /var/log/network/FIREWALL_03052014.log.1.1.1.1.1.4 to /var/log/network/FIREWALL_03052014.log.1.1.1.1.1.5 (rotatecount 5, logstart 1, i 4),
old log /var/log/network/FIREWALL_03052014.log.1.1.1.1.1.4 does not exist
renaming /var/log/network/FIREWALL_03052014.log.1.1.1.1.1.3 to /var/log/network/FIREWALL_03052014.log.1.1.1.1.1.4 (rotatecount 5, logstart 1, i 3),
old log /var/log/network/FIREWALL_03052014.log.1.1.1.1.1.3 does not exist
renaming /var/log/network/FIREWALL_03052014.log.1.1.1.1.1.2 to /var/log/network/FIREWALL_03052014.log.1.1.1.1.1.3 (rotatecount 5, logstart 1, i 2),
old log /var/log/network/FIREWALL_03052014.log.1.1.1.1.1.2 does not exist
renaming /var/log/network/FIREWALL_03052014.log.1.1.1.1.1.1 to /var/log/network/FIREWALL_03052014.log.1.1.1.1.1.2 (rotatecount 5, logstart 1, i 1),
old log /var/log/network/FIREWALL_03052014.log.1.1.1.1.1.1 does not exist
renaming /var/log/network/FIREWALL_03052014.log.1.1.1.1.1.0 to /var/log/network/FIREWALL_03052014.log.1.1.1.1.1.1 (rotatecount 5, logstart 1, i 0),
old log /var/log/network/FIREWALL_03052014.log.1.1.1.1.1.0 does not exist
log /var/log/network/FIREWALL_03052014.log.1.1.1.1.1.6 doesn't exist -- won't try to dispose of it
renaming /var/log/network/FIREWALL_03052014.log.1.1.1.1.1 to /var/log/network/FIREWALL_03052014.log.1.1.1.1.1.1
rotating log /var/log/network/FIREWALL_03062014.log.1.1.1.1.1, log->rotateCount is 5
dateext suffix '-20140312'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
renaming /var/log/network/FIREWALL_03062014.log.1.1.1.1.1.5 to /var/log/network/FIREWALL_03062014.log.1.1.1.1.1.6 (rotatecount 5, logstart 1, i 5),
old log /var/log/network/FIREWALL_03062014.log.1.1.1.1.1.5 does not exist
renaming /var/log/network/FIREWALL_03062014.log.1.1.1.1.1.4 to /var/log/network/FIREWALL_03062014.log.1.1.1.1.1.5 (rotatecount 5, logstart 1, i 4),
old log /var/log/network/FIREWALL_03062014.log.1.1.1.1.1.4 does not exist
renaming /var/log/network/FIREWALL_03062014.log.1.1.1.1.1.3 to /var/log/network/FIREWALL_03062014.log.1.1.1.1.1.4 (rotatecount 5, logstart 1, i 3),
old log /var/log/network/FIREWALL_03062014.log.1.1.1.1.1.3 does not exist
renaming /var/log/network/FIREWALL_03062014.log.1.1.1.1.1.2 to /var/log/network/FIREWALL_03062014.log.1.1.1.1.1.3 (rotatecount 5, logstart 1, i 2),
old log /var/log/network/FIREWALL_03062014.log.1.1.1.1.1.2 does not exist
renaming /var/log/network/FIREWALL_03062014.log.1.1.1.1.1.1 to /var/log/network/FIREWALL_03062014.log.1.1.1.1.1.2 (rotatecount 5, logstart 1, i 1),
old log /var/log/network/FIREWALL_03062014.log.1.1.1.1.1.1 does not exist
renaming /var/log/network/FIREWALL_03062014.log.1.1.1.1.1.0 to /var/log/network/FIREWALL_03062014.log.1.1.1.1.1.1 (rotatecount 5, logstart 1, i 0),
old log /var/log/network/FIREWALL_03062014.log.1.1.1.1.1.0 does not exist
log /var/log/network/FIREWALL_03062014.log.1.1.1.1.1.6 doesn't exist -- won't try to dispose of it
renaming /var/log/network/FIREWALL_03062014.log.1.1.1.1.1 to /var/log/network/FIREWALL_03062014.log.1.1.1.1.1.1
rotating log /var/log/network/FIREWALL_03072014.log.1.1.1.1.1, log->rotateCount is 5
dateext suffix '-20140312'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
renaming /var/log/network/FIREWALL_03072014.log.1.1.1.1.1.5 to /var/log/network/FIREWALL_03072014.log.1.1.1.1.1.6 (rotatecount 5, logstart 1, i 5),
old log /var/log/network/FIREWALL_03072014.log.1.1.1.1.1.5 does not exist
renaming /var/log/network/FIREWALL_03072014.log.1.1.1.1.1.4 to /var/log/network/FIREWALL_03072014.log.1.1.1.1.1.5 (rotatecount 5, logstart 1, i 4),
old log /var/log/network/FIREWALL_03072014.log.1.1.1.1.1.4 does not exist
renaming /var/log/network/FIREWALL_03072014.log.1.1.1.1.1.3 to /var/log/network/FIREWALL_03072014.log.1.1.1.1.1.4 (rotatecount 5, logstart 1, i 3),
old log /var/log/network/FIREWALL_03072014.log.1.1.1.1.1.3 does not exist
renaming /var/log/network/FIREWALL_03072014.log.1.1.1.1.1.2 to /var/log/network/FIREWALL_03072014.log.1.1.1.1.1.3 (rotatecount 5, logstart 1, i 2),
old log /var/log/network/FIREWALL_03072014.log.1.1.1.1.1.2 does not exist
renaming /var/log/network/FIREWALL_03072014.log.1.1.1.1.1.1 to /var/log/network/FIREWALL_03072014.log.1.1.1.1.1.2 (rotatecount 5, logstart 1, i 1),
old log /var/log/network/FIREWALL_03072014.log.1.1.1.1.1.1 does not exist
renaming /var/log/network/FIREWALL_03072014.log.1.1.1.1.1.0 to /var/log/network/FIREWALL_03072014.log.1.1.1.1.1.1 (rotatecount 5, logstart 1, i 0),
old log /var/log/network/FIREWALL_03072014.log.1.1.1.1.1.0 does not exist
log /var/log/network/FIREWALL_03072014.log.1.1.1.1.1.6 doesn't exist -- won't try to dispose of it
renaming /var/log/network/FIREWALL_03072014.log.1.1.1.1.1 to /var/log/network/FIREWALL_03072014.log.1.1.1.1.1.1
rotating log /var/log/network/FIREWALL_03082014.log.1.1.1.1.1, log->rotateCount is 5
dateext suffix '-20140312'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
renaming /var/log/network/FIREWALL_03082014.log.1.1.1.1.1.5 to /var/log/network/FIREWALL_03082014.log.1.1.1.1.1.6 (rotatecount 5, logstart 1, i 5),
old log /var/log/network/FIREWALL_03082014.log.1.1.1.1.1.5 does not exist
renaming /var/log/network/FIREWALL_03082014.log.1.1.1.1.1.4 to /var/log/network/FIREWALL_03082014.log.1.1.1.1.1.5 (rotatecount 5, logstart 1, i 4),
old log /var/log/network/FIREWALL_03082014.log.1.1.1.1.1.4 does not exist
renaming /var/log/network/FIREWALL_03082014.log.1.1.1.1.1.3 to /var/log/network/FIREWALL_03082014.log.1.1.1.1.1.4 (rotatecount 5, logstart 1, i 3),
old log /var/log/network/FIREWALL_03082014.log.1.1.1.1.1.3 does not exist
renaming /var/log/network/FIREWALL_03082014.log.1.1.1.1.1.2 to /var/log/network/FIREWALL_03082014.log.1.1.1.1.1.3 (rotatecount 5, logstart 1, i 2),
old log /var/log/network/FIREWALL_03082014.log.1.1.1.1.1.2 does not exist
renaming /var/log/network/FIREWALL_03082014.log.1.1.1.1.1.1 to /var/log/network/FIREWALL_03082014.log.1.1.1.1.1.2 (rotatecount 5, logstart 1, i 1),
old log /var/log/network/FIREWALL_03082014.log.1.1.1.1.1.1 does not exist
renaming /var/log/network/FIREWALL_03082014.log.1.1.1.1.1.0 to /var/log/network/FIREWALL_03082014.log.1.1.1.1.1.1 (rotatecount 5, logstart 1, i 0),
old log /var/log/network/FIREWALL_03082014.log.1.1.1.1.1.0 does not exist
log /var/log/network/FIREWALL_03082014.log.1.1.1.1.1.6 doesn't exist -- won't try to dispose of it
renaming /var/log/network/FIREWALL_03082014.log.1.1.1.1.1 to /var/log/network/FIREWALL_03082014.log.1.1.1.1.1.1
rotating log /var/log/network/FIREWALL_03092014.log.1.1.1.1.1, log->rotateCount is 5
dateext suffix '-20140312'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
renaming /var/log/network/FIREWALL_03092014.log.1.1.1.1.1.5 to /var/log/network/FIREWALL_03092014.log.1.1.1.1.1.6 (rotatecount 5, logstart 1, i 5),
old log /var/log/network/FIREWALL_03092014.log.1.1.1.1.1.5 does not exist
renaming /var/log/network/FIREWALL_03092014.log.1.1.1.1.1.4 to /var/log/network/FIREWALL_03092014.log.1.1.1.1.1.5 (rotatecount 5, logstart 1, i 4),
old log /var/log/network/FIREWALL_03092014.log.1.1.1.1.1.4 does not exist
renaming /var/log/network/FIREWALL_03092014.log.1.1.1.1.1.3 to /var/log/network/FIREWALL_03092014.log.1.1.1.1.1.4 (rotatecount 5, logstart 1, i 3),
old log /var/log/network/FIREWALL_03092014.log.1.1.1.1.1.3 does not exist
renaming /var/log/network/FIREWALL_03092014.log.1.1.1.1.1.2 to /var/log/network/FIREWALL_03092014.log.1.1.1.1.1.3 (rotatecount 5, logstart 1, i 2),
old log /var/log/network/FIREWALL_03092014.log.1.1.1.1.1.2 does not exist
renaming /var/log/network/FIREWALL_03092014.log.1.1.1.1.1.1 to /var/log/network/FIREWALL_03092014.log.1.1.1.1.1.2 (rotatecount 5, logstart 1, i 1),
old log /var/log/network/FIREWALL_03092014.log.1.1.1.1.1.1 does not exist
renaming /var/log/network/FIREWALL_03092014.log.1.1.1.1.1.0 to /var/log/network/FIREWALL_03092014.log.1.1.1.1.1.1 (rotatecount 5, logstart 1, i 0),
old log /var/log/network/FIREWALL_03092014.log.1.1.1.1.1.0 does not exist
log /var/log/network/FIREWALL_03092014.log.1.1.1.1.1.6 doesn't exist -- won't try to dispose of it
renaming /var/log/network/FIREWALL_03092014.log.1.1.1.1.1 to /var/log/network/FIREWALL_03092014.log.1.1.1.1.1.1
rotating log /var/log/network/FIREWALL_03102014.log.1.1.1.1.1, log->rotateCount is 5
dateext suffix '-20140312'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
renaming /var/log/network/FIREWALL_03102014.log.1.1.1.1.1.5 to /var/log/network/FIREWALL_03102014.log.1.1.1.1.1.6 (rotatecount 5, logstart 1, i 5),
old log /var/log/network/FIREWALL_03102014.log.1.1.1.1.1.5 does not exist
renaming /var/log/network/FIREWALL_03102014.log.1.1.1.1.1.4 to /var/log/network/FIREWALL_03102014.log.1.1.1.1.1.5 (rotatecount 5, logstart 1, i 4),
old log /var/log/network/FIREWALL_03102014.log.1.1.1.1.1.4 does not exist
renaming /var/log/network/FIREWALL_03102014.log.1.1.1.1.1.3 to /var/log/network/FIREWALL_03102014.log.1.1.1.1.1.4 (rotatecount 5, logstart 1, i 3),
old log /var/log/network/FIREWALL_03102014.log.1.1.1.1.1.3 does not exist
renaming /var/log/network/FIREWALL_03102014.log.1.1.1.1.1.2 to /var/log/network/FIREWALL_03102014.log.1.1.1.1.1.3 (rotatecount 5, logstart 1, i 2),
old log /var/log/network/FIREWALL_03102014.log.1.1.1.1.1.2 does not exist
renaming /var/log/network/FIREWALL_03102014.log.1.1.1.1.1.1 to /var/log/network/FIREWALL_03102014.log.1.1.1.1.1.2 (rotatecount 5, logstart 1, i 1),
old log /var/log/network/FIREWALL_03102014.log.1.1.1.1.1.1 does not exist
renaming /var/log/network/FIREWALL_03102014.log.1.1.1.1.1.0 to /var/log/network/FIREWALL_03102014.log.1.1.1.1.1.1 (rotatecount 5, logstart 1, i 0),
old log /var/log/network/FIREWALL_03102014.log.1.1.1.1.1.0 does not exist
log /var/log/network/FIREWALL_03102014.log.1.1.1.1.1.6 doesn't exist -- won't try to dispose of it
renaming /var/log/network/FIREWALL_03102014.log.1.1.1.1.1 to /var/log/network/FIREWALL_03102014.log.1.1.1.1.1.1
rotating log /var/log/network/FIREWALL_03112014.log.1.1.1.1.1, log->rotateCount is 5
dateext suffix '-20140312'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
renaming /var/log/network/FIREWALL_03112014.log.1.1.1.1.1.5 to /var/log/network/FIREWALL_03112014.log.1.1.1.1.1.6 (rotatecount 5, logstart 1, i 5),
old log /var/log/network/FIREWALL_03112014.log.1.1.1.1.1.5 does not exist
renaming /var/log/network/FIREWALL_03112014.log.1.1.1.1.1.4 to /var/log/network/FIREWALL_03112014.log.1.1.1.1.1.5 (rotatecount 5, logstart 1, i 4),
old log /var/log/network/FIREWALL_03112014.log.1.1.1.1.1.4 does not exist
renaming /var/log/network/FIREWALL_03112014.log.1.1.1.1.1.3 to /var/log/network/FIREWALL_03112014.log.1.1.1.1.1.4 (rotatecount 5, logstart 1, i 3),
old log /var/log/network/FIREWALL_03112014.log.1.1.1.1.1.3 does not exist
renaming /var/log/network/FIREWALL_03112014.log.1.1.1.1.1.2 to /var/log/network/FIREWALL_03112014.log.1.1.1.1.1.3 (rotatecount 5, logstart 1, i 2),
old log /var/log/network/FIREWALL_03112014.log.1.1.1.1.1.2 does not exist
renaming /var/log/network/FIREWALL_03112014.log.1.1.1.1.1.1 to /var/log/network/FIREWALL_03112014.log.1.1.1.1.1.2 (rotatecount 5, logstart 1, i 1),
old log /var/log/network/FIREWALL_03112014.log.1.1.1.1.1.1 does not exist
renaming /var/log/network/FIREWALL_03112014.log.1.1.1.1.1.0 to /var/log/network/FIREWALL_03112014.log.1.1.1.1.1.1 (rotatecount 5, logstart 1, i 0),
old log /var/log/network/FIREWALL_03112014.log.1.1.1.1.1.0 does not exist
log /var/log/network/FIREWALL_03112014.log.1.1.1.1.1.6 doesn't exist -- won't try to dispose of it
renaming /var/log/network/FIREWALL_03112014.log.1.1.1.1.1 to /var/log/network/FIREWALL_03112014.log.1.1.1.1.1.1
rotating log /var/log/network/FIREWALL_03122014.log.1.1.1.1.1, log->rotateCount is 5
dateext suffix '-20140312'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
renaming /var/log/network/FIREWALL_03122014.log.1.1.1.1.1.5 to /var/log/network/FIREWALL_03122014.log.1.1.1.1.1.6 (rotatecount 5, logstart 1, i 5),
old log /var/log/network/FIREWALL_03122014.log.1.1.1.1.1.5 does not exist
renaming /var/log/network/FIREWALL_03122014.log.1.1.1.1.1.4 to /var/log/network/FIREWALL_03122014.log.1.1.1.1.1.5 (rotatecount 5, logstart 1, i 4),
old log /var/log/network/FIREWALL_03122014.log.1.1.1.1.1.4 does not exist
renaming /var/log/network/FIREWALL_03122014.log.1.1.1.1.1.3 to /var/log/network/FIREWALL_03122014.log.1.1.1.1.1.4 (rotatecount 5, logstart 1, i 3),
old log /var/log/network/FIREWALL_03122014.log.1.1.1.1.1.3 does not exist
renaming /var/log/network/FIREWALL_03122014.log.1.1.1.1.1.2 to /var/log/network/FIREWALL_03122014.log.1.1.1.1.1.3 (rotatecount 5, logstart 1, i 2),
old log /var/log/network/FIREWALL_03122014.log.1.1.1.1.1.2 does not exist
renaming /var/log/network/FIREWALL_03122014.log.1.1.1.1.1.1 to /var/log/network/FIREWALL_03122014.log.1.1.1.1.1.2 (rotatecount 5, logstart 1, i 1),
old log /var/log/network/FIREWALL_03122014.log.1.1.1.1.1.1 does not exist
renaming /var/log/network/FIREWALL_03122014.log.1.1.1.1.1.0 to /var/log/network/FIREWALL_03122014.log.1.1.1.1.1.1 (rotatecount 5, logstart 1, i 0),
old log /var/log/network/FIREWALL_03122014.log.1.1.1.1.1.0 does not exist
log /var/log/network/FIREWALL_03122014.log.1.1.1.1.1.6 doesn't exist -- won't try to dispose of it
renaming /var/log/network/FIREWALL_03122014.log.1.1.1.1.1 to /var/log/network/FIREWALL_03122014.log.1.1.1.1.1.1