理解logrotate的行为需要帮助

Question

/etc/logrotate.conf中说：rotate logs "weekly"

/etc/logrotate.d/ssh说

/var/log/ssh.log { 
compress 
dateext 
maxage 120 
rotate 99 
missingok 
notifempty 
size +4096k 
create 640 root p4admin 
sharedscripts 
postrotate 
/etc/init.d/syslog reload 
endscript 
} 

/var/lib/logrotate.status上说上次旋转SSH “/var/log/ssh.log” 2013年1月4日

但上面没有我们的文件中看到的数据匹配...

-rw-r----- 1 root user 201M Jan 4 09:47 /var/log/ssh.log 
-rw-r----- 1 root user 65M Oct 19 04:02 /var/log/ssh.log-20121019.gz 
-rw-r----- 1 root user 64M Nov 28 04:02 /var/log/ssh.log-20121128.gz 
-rw-r----- 1 root user 63M Oct 23 04:02 /var/log/ssh.log-20121023.gz 

任何想法，我错过了什么？

Answer 1

• weekly在/etc/logrotate.conf意味着所有的日志文件将每周轮换，如果这个选项未在本地覆盖。

  手册上说：

  Each configuration file can set global options (local definitions over- 
  ride global ones, and later definitions override earlier ones) and 
  specify logfiles to rotate. 
  

• 如果size选项时，logrotate的将忽略daily，weekly，monthly，并yearly选项说明here

• 日志轮播每天执行以检查尺寸等标准。如果适用，日志会同时旋转。

  手册上说：

  Normally, logrotate is run as a daily cron job. It will not modify a 
  log multiple times in one day unless the criterion for that log is 
  based on the log's size and logrotate is being run multiple times each 
  day, or unless the -f or --force option is used. 
  

因此，logrotate的检查日志日常的大小，它在必要时进行转动。