Ubuntu syslog 清理策略
一 策略总览
二 推荐配置示例
logrotate 配置(/etc/logrotate.d/rsyslog,适用于 rsyslog)
/var/log/syslog
/var/log/auth.log
/var/log/kern.log
/var/log/mail.log
/var/log/cron.log
/var/log/daemon.log
/var/log/debug
/var/log/lpr.log
/var/log/user.log
/var/log/uucp.log {
daily
size 100M
rotate 7
compress
delaycompress
missingok
notifempty
create 0640 root adm
postrotate
/usr/lib/rsyslog/rsyslog-rotate
endscript
}
sudo logrotate -d /etc/logrotate.d/rsyslogsudo logrotate -f /etc/logrotate.d/rsyslogsystemd-journald 配置(/etc/systemd/journald.conf)
[Journal]
Storage=persistent
SystemMaxUse=500M
SystemKeepFree=100M
MaxRetentionSec=7day
sudo systemctl restart systemd-journaldjournalctl --vacuum-size=500M 或 --vacuum-time=7d 做临时收缩。三 应急清理与风险控制
sudo truncate -s 0 /var/log/syslogsudo truncate -s 0 /var/log/auth.logsudo find /var/log -name "*.gz" -mtime +7 -deletesudo journalctl --vacuum-size=500Msudo journalctl --vacuum-time=7drm /var/log/syslog;如确需删除主日志,应先停止写入并重建,或优先使用 truncate/logrotate。四 监控与容量规划
du -sh /var/logsudo du -ah /var/log | sort -rh | head -n 20sudo journalctl --disk-usage五 常见排错与优化
logrotate -d 演练;确认 /etc/cron.daily/logrotate 存在且未被禁用;必要时 systemctl restart rsyslog。postrotate /usr/lib/rsyslog/rsyslog-rotate 存在且可执行;若手动清空过日志,可重启 rsyslog 以重建文件句柄。