做一个apache日志回滚和分割的简单配置

摘要：介绍默认日志默认不分割的，长时间不清理日志就会占满磁盘空间，而且一个整文件既不利于管理也不利于分析统计。通常与服务器一起使用，例如用来安全地对日志文件按日期月或其它特定的区间进行分割。

默认apache日志默认不分割的，长时间不清理apache日志就会占满磁盘空间，而且一个整文件既不利于管理也不利于分析统计。（其他日志也如此）

什么cronolog?

cronolog是一个简单的过滤程序，它从标准输入设备读入日志记录，并把这些记录写入到输出文件集，输出文件的名字由一个文件名模板和当前的日期时间组成。cronolog通常与web服务器一起使用，例如apache,用来安全地对日志文件按日期、月或其它特定的区间进行分割。当然也可以配置来分割其他服务的日志，如nginx,lighttpd。

详情参考 man cronolog，这里用apache举例。

yum -y install cronolog

  
cronolog官网已经不用了，但是centos的yum已经包含了该软件，所以可以直接下载

apache的虚拟主机的日志的cronolog配置

cat /app/server/httpd/conf/vhosts/test.com.conf

     DocumentRoot /app/www/test.com
     ServerName test.com
     
         Options -Indexes FollowSymLinks
         DirectoryIndex index.php index.html
         AllowOverride all
         Order allow,deny
         Allow from all
     
     ErrorLog "|/usr/sbin/cronolog /app/server/httpd/logs/test.com-error_%Y%m%d.log"
     CustomLog "|/usr/sbin/cronolog /app/server/httpd/logs/test.com_%Y%m%d.log" combined

  
在虚拟主机基础配置上修改errorlog和customlog的配置而已，其他配置只是参考，无关cronolog的。

配置完成后检查配置文件是否正常

 /app/server/httpd/bin/apachectl -t
Syntax OK

配置完成后需要完全关闭apache所有进程后再启动

service httpd stop

ps -ef|grep httpd

service httpd start

  
其实所有的系统操作都应该是谨慎而彻底的，确认上一步进行无误后方可进行下一步操作。

检查cronolog运行情况

ps -ef|grep cronolog
root  1006 1  0 Feb04 ?00:00:01 crond
root 22511  5290  0 15:51 ?00:00:00 /usr/sbin/cronolog /app/server/httpd/logs/wifi-www.luckygz.com_1234-error_%Y%m%d.log
root 22512  5290  0 15:51 ?00:00:00 /usr/sbin/cronolog /app/server/httpd/logs/test.com-error_%Y%m%d.log
root 22513  5290  0 15:51 ?00:00:00 /usr/sbin/cronolog /app/server/httpd/logs/test.com_%Y%m%d.log

检查日志是否开始分割

ls -lh /app/server/httpd/logs/|grep "test.com"

  
1.正常情况下日志会按照配置进行分割，例如我这里是test.com_20150215.log

  2.重启apache后，要有web请求访问网站，新的日志才会生成，不然的话是看不到效果的，虽然配置已经生效

  3.原来的test.com.log还是会存在，你可以保留或者删掉

至此完成基本配置，基本实现需求。

但这里还想做多一步，就是日志分割了也依然比较大，因为纯文本很大，所以需要做定期压缩

#!/bin/bash

log_dir="/app/server/httpd/logs"
days="5"
log_bak_dir="/app/server/httpd/logs/bak"


find ${log_dir} -name "*.log" -type f -mtime +${days}|grep -v "bak" |xargs -I "{}" mv "{}" ${log_bak_dir}

cd ${log_bak_dir}
for i in `ls -1 ${log_bak_dir}`
do
 gzip $i
done

  
脚本使用了find和一个for循环来完成，最终的效果就自动将匹配条件的日志文件转移到指定目录，然后进行压缩。

apache默认日志的cronolog配置

cat /app/server/httpd/conf/httpd.conf

ErrorLog "|/usr/sbin/cronolog /app/server/httpd/logs/error_log"
CustomLog "|/usr/sbin/cronolog /app/server/httpd/logs/access_log" common

  
默认的httpd.conf全局日志error_log 和 access_log是不可以直接使用相对路径来进行分割的，所以需要写全路径，如上。

cronolog的配置非常简单，可以在apache里直接调用，使用方法也很简便，直接写时间就可以指定时间分割，下面做了一些解释和例子参考。

   cronolog is intended to be used in conjunction with a Web server, such as Apache to split the access log into daily or monthly logs.  For example the Apache configuration directives:

           TransferLog "|/usr/sbin/cronolog /www/logs/%Y/%m/%d/access.log"
           ErrorLog    "|/usr/sbin/cronolog /www/logs/%Y/%m/%d/errors.log"

   would instruct Apache to pipe its access and error log messages into separate copies of cronolog, which would create new log files each day in a directory hierarchy structured by date, i.e. on  31  December
   1996 messages would be written to

           /www/logs/1996/12/31/access.log
           /www/logs/1996/12/31/errors.log

   after midnight the files

           /www/logs/1997/01/01/access.log
           /www/logs/1997/01/01/errors.log

而时间的格式是使用strftime function，不过根据介绍，基本能看懂，%是说明符，H代表0-23小时，24小时制，如此类推

Template format
   Each  character  in  the template represents a character in the expanded filename, except for date and time format specifiers, which are replaced by their expansion.  Format specifiers consist of a ‘%’ fol-
   lowed by one of the following characters:

   %      a literal % character

   n      a new-line character

   t      a horizontal tab character

   Time fields:

   H      hour (00..23)

   I      hour (01..12)

   p      the locale’s AM or PM indicator

   M      minute (00..59)

   S      second (00..61, which allows for leap seconds)

   X      the locale’s time representation (e.g.: "15:12:47")

   Z      time zone (e.g. GMT), or nothing if the time zone cannot be determined

   Date fields:

   a      the locale’s abbreviated weekday name (e.g.: Sun..Sat)

   A      the locale’s full weekday name (e.g.: Sunday .. Saturday)

   b      the locale’s abbreviated month name (e.g.: Jan .. Dec)

   B      the locale’s full month name, (e.g.: January .. December)

   c      the locale’s date and time (e.g.: "Sun Dec 15 14:12:47 GMT 1996")

   d      day of month (01 .. 31)

   j      day of year (001 .. 366)

   m      month (01 .. 12)

   U      week of the year with Sunday as first day of week (00..53, where week 1 is the week containing the first Sunday of the year)

   W      week of the year with Monday as first day of week (00..53, where week 1 is the week containing the first Monday of the year)

   w      day of week (0 .. 6, where 0 corresponds to Sunday)

   x      locale’s date representation (e.g. today in April in Britain: "13/04/97")

   y      year without the century (00 .. 99)

   Y      year with the century (1970 .. 2038)

   Other specifiers may be available depending on the C library’s implementation of the strftime function.

原文链接：http://www.godblessyuan.com/2015/02/15/apache_cronolog_log_split_rollback/