目錄表

[FreeBSD] newsyslog: Log Management and Rotation

0x00 前言

今天沒事翻翻機器的 http access log，沒開還好，一開不得了

因為機器開的是低階方案，資源沒有很多，但 log 日積月累越長越大，一開起來就把整個系統卡住了

console 噴出 swap_pager_getswapspace failed 訊息，基本上就是 swap 空間不夠了

等了好一會才恢復，不過這樣我的 log 開不起來，那紀錄 log 就沒意義啦

所以這邊使用 freebsd 內建的 newsyslog 來做 log 的管理

0x01 newsyslog

newsyslog 是透過系統的 cron 來定期執行的

他用來壓縮 (compress)，翻轉 (rotation) log file 

# configuration file for newsyslog
# $FreeBSD: releng/11.1/etc/newsyslog.conf 266463 2014-05-20 03:00:20Z bdrewery $
#
# Entries which do not specify the '/pid_file' field will cause the
# syslogd process to be signalled when that log file is rotated.  This
# action is only appropriate for log files which are written to by the
# syslogd process (ie, files listed in /etc/syslog.conf).  If there
# is no process which needs to be signalled when a given log file is
# rotated, then the entry for that file should include the 'N' flag.
#
# The 'flags' field is one or more of the letters: BCDGJNUXZ or a '-'.
#
# Note: some sites will want to select more restrictive protections than the
# defaults.  In particular, it may be desirable to switch many of the 644
# entries to 640 or 600.  For example, some sites will consider the
# contents of maillog, messages, and lpd-errs to be confidential.  In the
# future, these defaults may change to more conservative ones.
#
# logfilename          [owner:group]    mode count size when  flags [/pid_file] [sig_num]
/var/log/all.log			600  7	   *	@T00  J
/var/log/amd.log			644  7	   100	*     J
/var/log/auth.log			600  7     100  @0101T JC
/var/log/console.log			600  5	   100	*     J
/var/log/cron				600  3	   100	*     JC
/var/log/daily.log			640  7	   *	@T00  JN
/var/log/debug.log			600  7     100  *     JC
/var/log/init.log			644  3	   100	*     J
/var/log/kerberos.log			600  7	   100	*     J
/var/log/lpd-errs			644  7	   100	*     JC
/var/log/maillog			640  7	   *	@T00  JC
/var/log/messages			644  5	   100	@0101T JC
/var/log/monthly.log			640  12	   *	$M1D0 JN
/var/log/pflog				600  3	   100	*     JB    /var/run/pflogd.pid
/var/log/ppp.log	root:network	640  3	   100	*     JC
/var/log/devd.log			644  3	   100	*     JC
/var/log/security			600  10	   100	*     JC
/var/log/sendmail.st			640  10	   *	168   BN
/var/log/utx.log			644  3	   *	@01T05 B
/var/log/weekly.log			640  5	   *	$W6D0 JN
/var/log/xferlog			600  7	   100	*     JC
/var/log/httpd-access.log       644 180 *   @T00    JC  /var/run/httpd.pid  30
/var/log/httpd-error.log        644 180 *   @T00    JC  /var/run/httpd.pid  30


<include> /etc/newsyslog.conf.d/*
<include> /usr/local/etc/newsyslog.conf.d/*

在 /etc/newsyslog 中加入 line 41-42 兩行

不用重啟服務，儲存之就行啦

0x02 參考資料