Linux日志滚动(logrotate)的保存文件数(maxaget和rotate参数)

确认Linux的logrotate设定里的rotate和maxage参数的关系。

下面是man logrotate命令的输出结果里摘取的内容。重要的是rotate默认值是0，从描述上理解为不指定rotate参数时旧版本的日志文件将被删除。

rotate count
Log files are rotated count times before being removed or mailed to the address specified in a mail directive.
If count is 0, old versions are removed rather than rotated. If count is -1, old logs are not removed at all,
except they are affected by maxage (use with caution, may waste performance and disk space). Default is 0.

maxage count
Remove rotated logs older than days. The age is only checked if the logfile is to be rotated. rotate -1 does not hinder removal.
The files are mailed to the configured address if maillast and mail are configured.

测试logrotate的OS为SUSE Linux Enterprise Desktop15 SP5。

# cat /etc/os-release
NAME="SLED"
VERSION="15-SP5"
VERSION_ID="15.5"
PRETTY_NAME="SUSE Linux Enterprise Desktop 15 SP5"
ID="sled"
ID_LIKE="suse"
ANSI_COLOR="0;32"
CPE_NAME="cpe:/o:suse:sled:15:sp5"
DOCUMENTATION_URL="https://documentation.suse.com/"

测试结果

测试4个case的结果如下。从这个结果可以看出maxage和rotate是or条件，当执行logrotate时日志文件满足其中一个条件将会被删除。

测试

测试文件的目录及设定文件如下。

• /var/log/demo
• /etc/logrotate.d/demo.conf

所有测试里使用的日志文件内容如下。

# ls -ltr /var/log/demo/
total 0
-rw-r--r-- 1 root root 0 Dec 19 01:01 demo.log.20231219
-rw-r--r-- 1 root root 0 Dec 20 01:01 demo.log.20231220
-rw-r--r-- 1 root root 0 Dec 21 01:01 demo.log.20231221
-rw-r--r-- 1 root root 0 Dec 22 01:01 demo.log.20231222
-rw-r--r-- 1 root root 0 Dec 23 01:01 demo.log.20231223
-rw-r--r-- 1 root root 0 Dec 24 01:01 demo.log.20231224
-rw-r--r-- 1 root root 0 Dec 25 01:01 demo.log.20231225
-rw-r--r-- 1 root root 0 Dec 26 01:01 demo.log.20231226
-rw-r--r-- 1 root root 0 Dec 27 01:01 demo.log.20231227
-rw-r--r-- 1 root root 0 Dec 28 01:01 demo.log

rotate(7)

logrotate设定文件内容如下。在这里仅指定了rotate参数，没有指定maxage参数。

# cat /etc/logrotate.d/demo.conf
/var/log/demo/demo.log {
    daily
    nocompress
    dateext
    rotate 7
    missingok
    size +4096k
    create 640 root root
    dateformat .%Y%m%d
    postrotate
        /usr/bin/systemctl reload syslog.service > /dev/null
    endscript
}

使用logrotate -vf /etc/logrotate.d/demo.conf执行日志滚动。

# date
Thu Dec 28 10:12:34 CST 2023
# logrotate -vf /etc/logrotate.d/demo.conf
reading config file /etc/logrotate.d/demo.conf
warning: 'size' overrides previously specified 'daily'
Reading state from file: /var/lib/misc/logrotate.status

Handling 1 logs

rotating pattern: /var/log/demo/demo.log  forced from command line (7 rotations)
empty log files are rotated, old logs are removed
considering log /var/log/demo/demo.log
  Now: 2023-12-28 10:12
  Last rotated at 2023-12-28 10:10
  log needs rotating
rotating log /var/log/demo/demo.log, log->rotateCount is 7
Converted '.%Y%m%d' -> '.%Y%m%d'
dateext suffix '.20231228'
glob pattern '.[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
removing /var/log/demo/demo.log.20231219
removing old log /var/log/demo/demo.log.20231219
removing /var/log/demo/demo.log.20231220
removing old log /var/log/demo/demo.log.20231220
renaming /var/log/demo/demo.log to /var/log/demo/demo.log.20231228
creating new /var/log/demo/demo.log mode = 0640 uid = 0 gid = 0
running postrotate script
removing old log /var/log/demo/demo.log.20231221

日志滚动后的结果，和期待的一样，保存了7个世代的旧版本文件。

# ls -ltr /var/log/demo/
total 0
-rw-r--r-- 1 root root 0 Dec 22 01:01 demo.log.20231222
-rw-r--r-- 1 root root 0 Dec 23 01:01 demo.log.20231223
-rw-r--r-- 1 root root 0 Dec 24 01:01 demo.log.20231224
-rw-r--r-- 1 root root 0 Dec 25 01:01 demo.log.20231225
-rw-r--r-- 1 root root 0 Dec 26 01:01 demo.log.20231226
-rw-r--r-- 1 root root 0 Dec 27 01:01 demo.log.20231227
-rw-r--r-- 1 root root 0 Dec 28 01:01 demo.log.20231228
-rw-r----- 1 root root 0 Dec 28 10:12 demo.log

maxage(7)

logrotate设定文件内容如下。在设定文件里仅指定了maxage，但是根据man logrotate结果来看，rotate参数应该是默认值0。

# cat /etc/logrotate.d/demo.conf
/var/log/demo/demo.log {
    daily
    nocompress
    dateext
    maxage 7
    missingok
    size +4096k
    create 640 root root
    dateformat .%Y%m%d
    postrotate
        /usr/bin/systemctl reload syslog.service > /dev/null
    endscript
}

使用logrotate -vf /etc/logrotate.d/demo.conf执行日志滚动。

# date
Thu Dec 28 10:16:14 CST 2023
# logrotate -vf /etc/logrotate.d/demo.conf
reading config file /etc/logrotate.d/demo.conf
warning: 'size' overrides previously specified 'daily'
Reading state from file: /var/lib/misc/logrotate.status

Handling 1 logs

rotating pattern: /var/log/demo/demo.log  forced from command line (no old logs will be kept)
empty log files are rotated, old logs are removed
considering log /var/log/demo/demo.log
  Now: 2023-12-28 10:16
  Last rotated at 2023-12-28 10:12
  log needs rotating
rotating log /var/log/demo/demo.log, log->rotateCount is 0
Converted '.%Y%m%d' -> '.%Y%m%d'
dateext suffix '.20231228'
glob pattern '.[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
removing /var/log/demo/demo.log.20231219
removing old log /var/log/demo/demo.log.20231219
removing /var/log/demo/demo.log.20231220
removing old log /var/log/demo/demo.log.20231220
removing /var/log/demo/demo.log.20231221
removing old log /var/log/demo/demo.log.20231221
removing /var/log/demo/demo.log.20231222
removing old log /var/log/demo/demo.log.20231222
removing /var/log/demo/demo.log.20231223
removing old log /var/log/demo/demo.log.20231223
removing /var/log/demo/demo.log.20231224
removing old log /var/log/demo/demo.log.20231224
removing /var/log/demo/demo.log.20231225
removing old log /var/log/demo/demo.log.20231225
removing /var/log/demo/demo.log.20231226
removing old log /var/log/demo/demo.log.20231226
renaming /var/log/demo/demo.log to /var/log/demo/demo.log.20231228
disposeName will be /var/log/demo/demo.log.20231228
creating new /var/log/demo/demo.log mode = 0640 uid = 0 gid = 0
running postrotate script
removing old log /var/log/demo/demo.log.20231228

日志滚动后的结果，和期待的不太一样。期待的结果是仅保留demo.log文件，其他文件全部被删除。而demo.log.20231227文件未被删除的原因，目前不太清楚。

# ls -ltr /var/log/demo/
total 0
-rw-r--r-- 1 root root 0 Dec 27 01:01 demo.log.20231227
-rw-r----- 1 root root 0 Dec 28 10:16 demo.log

maxage(7)，rotate(3)

logrotate设定文件内容如下。在这里指定了rotate和maxage参数。

# cat /etc/logrotate.d/demo.conf
/var/log/demo/demo.log {
    daily
    nocompress
    dateext
    rotate 3
    maxage 7
    missingok
    size +4096k
    create 640 root root
    dateformat .%Y%m%d
    postrotate
        /usr/bin/systemctl reload syslog.service > /dev/null
    endscript
}

使用logrotate -vf /etc/logrotate.d/demo.conf执行日志滚动。

# date
Thu Dec 28 10:38:59 CST 2023
# logrotate -vf /etc/logrotate.d/demo.conf
reading config file /etc/logrotate.d/demo.conf
warning: 'size' overrides previously specified 'daily'
Reading state from file: /var/lib/misc/logrotate.status

Handling 1 logs

rotating pattern: /var/log/demo/demo.log  forced from command line (3 rotations)
empty log files are rotated, old logs are removed
considering log /var/log/demo/demo.log
  Now: 2023-12-28 10:37
  Last rotated at 2023-12-28 10:32
  log needs rotating
rotating log /var/log/demo/demo.log, log->rotateCount is 3
Converted '.%Y%m%d' -> '.%Y%m%d'
dateext suffix '.20231228'
glob pattern '.[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
removing /var/log/demo/demo.log.20231219
removing old log /var/log/demo/demo.log.20231219
removing /var/log/demo/demo.log.20231220
removing old log /var/log/demo/demo.log.20231220
removing /var/log/demo/demo.log.20231221
removing old log /var/log/demo/demo.log.20231221
removing /var/log/demo/demo.log.20231222
removing old log /var/log/demo/demo.log.20231222
removing /var/log/demo/demo.log.20231223
removing old log /var/log/demo/demo.log.20231223
removing /var/log/demo/demo.log.20231224
removing old log /var/log/demo/demo.log.20231224
renaming /var/log/demo/demo.log to /var/log/demo/demo.log.20231228
creating new /var/log/demo/demo.log mode = 0640 uid = 0 gid = 0
running postrotate script
removing old log /var/log/demo/demo.log.20231225

日志滚动后的结果，和期待的一样，保存了3个世代的旧版本文件。

# ls -ltr /var/log/demo/
total 0
-rw-r--r-- 1 root root 0 Dec 26 01:01 demo.log.20231226
-rw-r--r-- 1 root root 0 Dec 27 01:01 demo.log.20231227
-rw-r----- 1 root root 0 Dec 28 01:01 demo.log.20231228
-rw-r----- 1 root root 0 Dec 28 10:37 demo.log

maxage(3)，rotate(7)

logrotate设定文件内容如下。在这里指定了rotate和maxage参数。

/var/log/demo/demo.log {
    daily
    nocompress
    dateext
    rotate 7
    maxage 3
    missingok
    size +4096k
    create 640 root root
    dateformat .%Y%m%d
    postrotate
        /usr/bin/systemctl reload syslog.service > /dev/null
    endscript
}

使用logrotate -vf /etc/logrotate.d/demo.conf执行日志滚动。

# date
Thu Dec 28 11:26:35 CST 2023
# logrotate -vf /etc/logrotate.d/demo.conf
reading config file /etc/logrotate.d/demo.conf
warning: 'size' overrides previously specified 'daily'
Reading state from file: /var/lib/misc/logrotate.status

Handling 1 logs

rotating pattern: /var/log/demo/demo.log  forced from command line (7 rotations)
empty log files are rotated, old logs are removed
considering log /var/log/demo/demo.log
  Now: 2023-12-28 11:26
  Last rotated at 2023-12-28 10:37
  log needs rotating
rotating log /var/log/demo/demo.log, log->rotateCount is 7
Converted '.%Y%m%d' -> '.%Y%m%d'
dateext suffix '.20231228'
glob pattern '.[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
removing /var/log/demo/demo.log.20231219
removing old log /var/log/demo/demo.log.20231219
removing /var/log/demo/demo.log.20231220
removing old log /var/log/demo/demo.log.20231220
removing /var/log/demo/demo.log.20231221
removing old log /var/log/demo/demo.log.20231221
removing /var/log/demo/demo.log.20231222
removing old log /var/log/demo/demo.log.20231222
removing /var/log/demo/demo.log.20231223
removing old log /var/log/demo/demo.log.20231223
renaming /var/log/demo/demo.log to /var/log/demo/demo.log.20231228
creating new /var/log/demo/demo.log mode = 0640 uid = 0 gid = 0
running postrotate script
removing old log /var/log/demo/demo.log.20231224

日志滚动后的结果，和期待的一样，保存了4个世代的旧版本文件。maxage指定了3，因此保留了20231225-20231227的3世代的文件，而demo.log.20231228文件是日志滚动后的结果。

# ls -ltr /var/log/demo/
total 0
-rw-r--r-- 1 root root 0 Dec 25 01:01 demo.log.20231225
-rw-r--r-- 1 root root 0 Dec 26 01:01 demo.log.20231226
-rw-r--r-- 1 root root 0 Dec 27 01:01 demo.log.20231227
-rw-r--r-- 1 root root 0 Dec 28 01:01 demo.log.20231228
-rw-r----- 1 root root 0 Dec 28 11:26 demo.log