问题描述
上周我在我的服务器上发现了一个问题，因为磁盘使用率是100％，我发现apache创建了一个60GB的巨大error.log文件。然后我将LogLevel更改为emerg，但是在一周之后它又是1.3GB，这肯定是太多了。此外，我有一个6MB的access.log和167MB的other_vhosts_access.log。所以我发现问题可能是logrotate无法正常工作。实际上，日志的gzip文件有一个非常旧的日期(2月23日)。所以我首先尝试更改apache2的logrotate文件的配置，为文件添加最大大小，现在看起来像这样：
/var/log/apache2/*.log {
weekly
size 500M
missingok
rotate 20
compress
delaycompress
notifempty
create 640 root adm
sharedscripts
postrotate
if /etc/init.d/apache2 status > /dev/null ; then \
/etc/init.d/apache2 reload > /dev/null; \
fi;
endscript
prerotate
if [ -d /etc/logrotate.d/httpd-prerotate ]; then \
run-parts /etc/logrotate.d/httpd-prerotate; \
fi; \
endscript
}
在此之后，我尝试手动强制logrotate运行apache的特定配置
logrotate -f /etc/logrotate.d/apache2
我收到了这个错误：
error: skipping "/var/log/apache2/access.log" because parent directory has insecure permissions (It's world writable or writable by group which is not "root") Set "su" directive in config file to tell logrotate which user/group should be used for rotation.
error: skipping "/var/log/apache2/error.log" because parent directory has insecure permissions (It's world writable or writable by group which is not "root") Set "su" directive in config file to tell logrotate which user/group should be used for rotation.
error: skipping "/var/log/apache2/other_vhosts_access.log" because parent directory has insecure permissions (It's world writable or writable by group which is not "root") Set "su" directive in config file to tell logrotate which user/group should be used for rotation.
奇怪的是，它在某种程度上运行旋转，创建一个空的error.log文件，但具有与旧文件不同的权限，而不是压缩现有的error.log。看看apache日志目录，现在看起来像这样：
-rwxrwxrwx 1 root adm 6.3M Oct 21 10:54 access.log
-rwxrwxrwx 1 root adm 22K Feb 18 2014 access.log.1
-rwxrwxrwx 1 root adm 7.0K Feb 16 2014 access.log.2.gz
-rwxrwxrwx 1 root adm 4.0K Feb 9 2014 access.log.3.gz
-rw------- 1 amministratore amministratore 0 Oct 21 10:32 error.log
-rw-r--r-- 1 root root 1.3G Oct 21 10:57 error.log.1
-rwxrwxrwx 1 root adm 167M Oct 21 10:57 other_vhosts_access.log
-rwxrwxrwx 1 root adm 225K Feb 23 2014 other_vhosts_access.log.1
-rwxrwxrwx 1 root adm 16K Feb 15 2014 other_vhosts_access.log.2.gz
-rwxrwxrwx 1 root adm 3.2K Feb 8 2014 other_vhosts_access.log.3.gz
那么正确的方法是什么？我应该更改/var /log /apache2目录的权限吗？ (现在是777)我没有设置这些权限，如果它是正确的我不知道。或者我应该告诉logrotate哪个用户用于轮换？如何？
最佳解决方案
只需将su root adm添加到配置文件：
/var/log/apache2/*.log {
# …
su root adm
}
次佳解决方案
按照网站的说明，我刚刚更改了logrotate配置文件，添加了请求的su指令，如下所示，现在它以正确的方式旋转。
su <user> <group>
第三种解决方案
我尝试使用force-rotate系统日志时，“父目录有不安全的权限”。这是我解决它的方式：
cat /etc/logrotate.conf
...
# use the syslog group by default, since this is the owning group
# of /var/log/syslog.
su root syslog
vim /etc/logrotate.d/rsyslog
# Add to top:
su root syslog
logrotate -f /etc/logrotate.d/rsyslog
# No errors now, log is rotated.