Java日志在CentOS上的安全存储实践
一 基本原则与目录规范
二 日志框架权限与轮转配置
<RollingFile name="Rolling"
fileName="/var/log/myapp/app.log"
filePattern="/var/log/myapp/app.%d{yyyy-MM-dd}.gz"
filePermissions="rw-r-----">
<PatternLayout pattern="%d %p %c{1.} [%t] %m%n"/>
<Policies>
<TimeBasedTriggeringPolicy interval="1" modulate="true"/>
</Policies>
</RollingFile>
三 系统侧加固与集中化采集
四 加密存储与脱敏
五 最小可用配置示例
sudo mkdir -p /var/log/myapp
sudo chown appuser:loggroup /var/log/myapp
sudo chmod 0750 /var/log/myapp
<Configuration status="WARN">
<Appenders>
<RollingFile name="Rolling"
fileName="/var/log/myapp/app.log"
filePattern="/var/log/myapp/app.%d{yyyy-MM-dd}.gz"
filePermissions="rw-r-----">
<PatternLayout pattern="%d{yyyy-MM-dd HH:mm:ss} %-5p %c{1.} [%t] %m%n"/>
<Policies>
<TimeBasedTriggeringPolicy interval="1" modulate="true"/>
</Policies>
</RollingFile>
</Appenders>
<Loggers>
<Root level="info">
<AppenderRef ref="Rolling"/>
</Root>
</Loggers>
</Configuration>
/var/log/myapp/*.log {
daily
rotate 30
compress
delaycompress
missingok
notifempty
create 0640 appuser loggroup
sharedscripts
postrotate
/usr/bin/systemctl kill -s USR1 myapp.service >/dev/null 2>&1 || true
endscript
}