Centos 7周期性任务日志rotation、过滤和core压缩的实现

1.centos7中cron脚本及其调用脚本的实现示例

[root@localhost cron.d]# pwd

/etc/cron.d

[root@localhost cron.d]# cat syslog

# Run mysys activity accounting tool every 10 minutes

*/5 * * * * root /usr/sbin/mysyslog.sh 2>&1 >> /var/log/mysys.log

# 0 * * * * root /usr/lib64/sa/sa1 600 6 &

# Generate a daily summary of process accounting at 23:53

*/5 * * * * root /usr/sbin/ipmilog.sh

#53 23 * * * root /usr/lib64/sa/sa2 -A

2. 实现日志rotation及其相关脚本

[root@localhost logrotate.d]# pwd

/etc/logrotate.d

[root@localhost logrotate.d]# cat selmon

/var/log/ipmi.log {

weekly

copytruncate

compress

missingok

notifempty

rotate 200

}

[root@localhost logrotate.d]# cat mysysmon

/var/log/mysys.log {

#weekly

daily

copytruncate

compress

dateext

create 644 root root

missingok

notifempty

rotate 10

}

[root@localhost logrotate.d]# cat smhmon

/var/sysdbase/eventlog.txt /var/sysdbase/eventlog {

weekly

copytruncate

ccompress

dateext

create 644 root root

missingok

notifempty

rotate 198

}

3. rsyslog.conf规则的更新

添加对ceph-fuse日志的支持：

:syslogtag,contains,"ceph-fuse" /var/log/lsd/ceph-fuse.log

添加对需要抓取分级日志的应用程序的输出：

# :syslogtag,"gluser-fire" /var/log/log.txt

#action(type="omfile" file="/var/log/log.txt")

if $programname == 'gluser-fire' then {

if $msg contains 'in print level 0' then

action(type="omfile" file="/var/log/log-level0.txt")

if $msg contains 'in print level 1' then

action(type="omfile" file="/var/log/log-level1.txt")

if $msg contains 'in print level 2' then

action(type="omfile" file="/var/log/log-level2.txt")

if $msg contains 'in print level 3' then

action(type="omfile" file="/var/log/log-level3.txt")

if $msg contains 'in print level 4' then

action(type="omfile" file="/var/log/log-level4.txt")

if $msg contains 'in print level 5' then

action(type="omfile" file="/var/log/log-level5.txt")

if $msg contains 'in print level 6' then

action(type="omfile" file="/var/log/log-level6.txt")

if $msg contains 'in print level 7' then

action(type="omfile" file="/var/log/log-level7.txt")

}

4.修改内核panic生成core的方式

1)在终端中输入ulimit -c 如果结果为0，说明当程序崩溃时，系统并不能生成core dump。

2)使用ulimit -c unlimited命令，开启core dump功能，并且不限制生成core dump文件的大小。如果需要限制，加数字限制即可。ulimit - c 1024

3）参考下面的命令实现core 压缩：

修改/proc/sys/kernel/core_pattern：

[root@localhost ~]# cat /usr/sbin/core_compresser

#!/bin/bash

exec gzip - > /var/core/app/core-$1-$2-$3.gz

#!/bin/bash

exec gzip - > /var/core/app/core-$1-$2-$3.gz

[root@localhost ~]# cat /proc/sys/kernel/core_pattern

/var/core/app/core-%e-%p-%t

[root@localhost ~]# echo "|/usr/sbin/core_compresser %e %p %t" > /proc/sys/kernel/core_pattern

[root@localhost ~]# cat /proc/sys/kernel/core_pattern

|/usr/sbin/core_compresser %e %p %t