Ubuntu Syslog 日志备份与恢复实操指南
一 备份方案总览
二 手动备份步骤
sudo mkdir -p /backup/logssudo cp /var/log/syslog "/backup/logs/syslog-$(date +%F_%H-%M-%S)"sudo gzip "/backup/logs/syslog-$(date +%F_%H-%M-%S)"ls -lh /backup/logs 与 tail -n 20 /backup/logs/syslog-*.gz三 自动化备份与长期归档
/etc/logrotate.d/rsyslog(或新建 /etc/logrotate.d/syslog)/var/log/syslog {
daily
rotate 7
compress
missingok
notifempty
create 0640 root adm
}
sudo logrotate -d /etc/logrotate.confsudo logrotate -f /etc/logrotate.d/rsyslog*.* @remote.example.com:514 # UDP
*.* @@remote.example.com:514 # TCP
sudo systemctl restart rsyslogsudo ufw allow 514/tcp 与 sudo ufw allow 514/udp四 恢复步骤
sudo systemctl stop rsyslogsudo cp /backup/logs/syslog-2025-08-01_00-00-00 /var/log/syslogsudo chown root:adm /var/log/syslog && sudo chmod 0640 /var/log/syslogsudo systemctl start rsyslogsudo lsof | grep syslog(示例输出中 PID=1234,FD=7w)sudo cp /proc/1234/fd/7 /var/log/syslogsudo systemctl restart rsyslogsudo systemctl status rsyslogsudo tail -n 50 /var/log/syslog五 注意事项与最佳实践
journalctl 导出(journalctl -o short-iso > syslog-$(date +%F).log)纳入同一备份流程。