当前位置: 首页>>技术教程>>正文


Apache和logrotate配置

, , ,

问题描述

上周我在我的服务器上发现了一个问题,因为磁盘使用率是100%,我发现apache创建了一个60GB的巨大error.log文件。然后我将LogLevel更改为emerg,但是在一周之后它又是1.3GB,这肯定是太多了。此外,我有一个6MB的access.log和167MB的other_vhosts_access.log。所以我发现问题可能是logrotate无法正常工作。实际上,日志的gzip文件有一个非常旧的日期(2月23日)。所以我首先尝试更改apache2的logrotate文件的配置,为文件添加最大大小,现在看起来像这样:

/var/log/apache2/*.log {
    weekly
    size 500M
    missingok
    rotate 20
    compress
    delaycompress
    notifempty
    create 640 root adm
    sharedscripts
    postrotate
                if /etc/init.d/apache2 status > /dev/null ; then \
                    /etc/init.d/apache2 reload > /dev/null; \
                fi;
    endscript
    prerotate
        if [ -d /etc/logrotate.d/httpd-prerotate ]; then \
            run-parts /etc/logrotate.d/httpd-prerotate; \
        fi; \
    endscript
}

在此之后,我尝试手动强制logrotate运行apache的特定配置

logrotate -f /etc/logrotate.d/apache2

我收到了这个错误:

error: skipping "/var/log/apache2/access.log" because parent directory has insecure permissions (It's world writable or writable by group which is not "root") Set "su" directive in config file to tell logrotate which user/group should be used for rotation.
error: skipping "/var/log/apache2/error.log" because parent directory has insecure permissions (It's world writable or writable by group which is not "root") Set "su" directive in config file to tell logrotate which user/group should be used for rotation.
error: skipping "/var/log/apache2/other_vhosts_access.log" because parent directory has insecure permissions (It's world writable or writable by group which is not "root") Set "su" directive in config file to tell logrotate which user/group should be used for rotation.

奇怪的是,它在某种程度上运行旋转,创建一个空的error.log文件,但具有与旧文件不同的权限,而不是压缩现有的error.log。看看apache日志目录,现在看起来像这样:

-rwxrwxrwx  1 root           adm            6.3M Oct 21 10:54 access.log
-rwxrwxrwx  1 root           adm             22K Feb 18  2014 access.log.1
-rwxrwxrwx  1 root           adm            7.0K Feb 16  2014 access.log.2.gz
-rwxrwxrwx  1 root           adm            4.0K Feb  9  2014 access.log.3.gz
-rw-------  1 amministratore amministratore    0 Oct 21 10:32 error.log
-rw-r--r--  1 root           root           1.3G Oct 21 10:57 error.log.1
-rwxrwxrwx  1 root           adm            167M Oct 21 10:57 other_vhosts_access.log
-rwxrwxrwx  1 root           adm            225K Feb 23  2014 other_vhosts_access.log.1
-rwxrwxrwx  1 root           adm             16K Feb 15  2014 other_vhosts_access.log.2.gz
-rwxrwxrwx  1 root           adm            3.2K Feb  8  2014 other_vhosts_access.log.3.gz

那么正确的方法是什么?我应该更改/var /log /apache2目录的权限吗? (现在是777)我没有设置这些权限,如果它是正确的我不知道。或者我应该告诉logrotate哪个用户用于轮换?如何?

最佳解决方案

只需将su root adm添加到配置文件:

/var/log/apache2/*.log {
    # …
    su root adm
}

次佳解决方案

按照网站的说明,我刚刚更改了logrotate配置文件,添加了请求的su指令,如下所示,现在它以正确的方式旋转。

su <user> <group>

第三种解决方案

我尝试使用force-rotate系统日志时,“父目录有不安全的权限”。这是我解决它的方式:

cat /etc/logrotate.conf
    ...
    # use the syslog group by default, since this is the owning group
    # of /var/log/syslog.
    su root syslog

vim /etc/logrotate.d/rsyslog
    # Add to top:
    su root syslog

logrotate -f /etc/logrotate.d/rsyslog
    # No errors now, log is rotated.

参考资料

本文由Ubuntu问答整理, 博文地址: https://ubuntuqa.com/article/6376.html,未经允许,请勿转载。