摘要：介紹默認日志默認不分割的，長時間不清理日志就會占滿磁盤空間，而且一個整文件既不利于管理也不利于分析統計。通常與服務器一起使用，例如用來安全地對日志文件按日期月或其它特定的區間進行分割。

默認apache日志默認不分割的，長時間不清理apache日志就會占滿磁盤空間，而且一個整文件既不利于管理也不利于分析統計。（其他日志也如此）

什么cronolog?

cronolog是一個簡單的過濾程序，它從標準輸入設備讀入日志記錄，并把這些記錄寫入到輸出文件集，輸出文件的名字由一個文件名模板和當前的日期時間組成。cronolog通常與web服務器一起使用，例如apache,用來安全地對日志文件按日期、月或其它特定的區間進行分割。當然也可以配置來分割其他服務的日志，如nginx,lighttpd。

詳情參考 man cronolog，這里用apache舉例。

yum -y install cronolog

  
cronolog官網已經不用了，但是centos的yum已經包含了該軟件，所以可以直接下載

apache的虛擬主機的日志的cronolog配置

cat /app/server/httpd/conf/vhosts/test.com.conf

     DocumentRoot /app/www/test.com
     ServerName test.com
     
         Options -Indexes FollowSymLinks
         DirectoryIndex index.php index.html
         AllowOverride all
         Order allow,deny
         Allow from all
     
     ErrorLog "|/usr/sbin/cronolog /app/server/httpd/logs/test.com-error_%Y%m%d.log"
     CustomLog "|/usr/sbin/cronolog /app/server/httpd/logs/test.com_%Y%m%d.log" combined

  
在虛擬主機基礎配置上修改errorlog和customlog的配置而已，其他配置只是參考，無關cronolog的。

配置完成后檢查配置文件是否正常

 /app/server/httpd/bin/apachectl -t
Syntax OK

配置完成后需要完全關閉apache所有進程后再啟動

service httpd stop

ps -ef|grep httpd

service httpd start

  
其實所有的系統操作都應該是謹慎而徹底的，確認上一步進行無誤后方可進行下一步操作。

檢查cronolog運行情況

ps -ef|grep cronolog
root  1006 1  0 Feb04 ?00:00:01 crond
root 22511  5290  0 15:51 ?00:00:00 /usr/sbin/cronolog /app/server/httpd/logs/wifi-www.luckygz.com_1234-error_%Y%m%d.log
root 22512  5290  0 15:51 ?00:00:00 /usr/sbin/cronolog /app/server/httpd/logs/test.com-error_%Y%m%d.log
root 22513  5290  0 15:51 ?00:00:00 /usr/sbin/cronolog /app/server/httpd/logs/test.com_%Y%m%d.log

檢查日志是否開始分割

ls -lh /app/server/httpd/logs/|grep "test.com"

  
1.正常情況下日志會按照配置進行分割，例如我這里是test.com_20150215.log

  2.重啟apache后，要有web請求訪問網站，新的日志才會生成，不然的話是看不到效果的，雖然配置已經生效

  3.原來的test.com.log還是會存在，你可以保留或者刪掉

至此完成基本配置，基本實現需求。

但這里還想做多一步，就是日志分割了也依然比較大，因為純文本很大，所以需要做定期壓縮

#!/bin/bash

log_dir="/app/server/httpd/logs"
days="5"
log_bak_dir="/app/server/httpd/logs/bak"


find ${log_dir} -name "*.log" -type f -mtime +${days}|grep -v "bak" |xargs -I "{}" mv "{}" ${log_bak_dir}

cd ${log_bak_dir}
for i in `ls -1 ${log_bak_dir}`
do
 gzip $i
done

  
腳本使用了find和一個for循環來完成，最終的效果就自動將匹配條件的日志文件轉移到指定目錄，然后進行壓縮。

apache默認日志的cronolog配置

cat /app/server/httpd/conf/httpd.conf

ErrorLog "|/usr/sbin/cronolog /app/server/httpd/logs/error_log"
CustomLog "|/usr/sbin/cronolog /app/server/httpd/logs/access_log" common

  
默認的httpd.conf全局日志error_log 和 access_log是不可以直接使用相對路徑來進行分割的，所以需要寫全路徑，如上。

cronolog的配置非常簡單，可以在apache里直接調用，使用方法也很簡便，直接寫時間就可以指定時間分割，下面做了一些解釋和例子參考。

   cronolog is intended to be used in conjunction with a Web server, such as Apache to split the access log into daily or monthly logs.  For example the Apache configuration directives:

           TransferLog "|/usr/sbin/cronolog /www/logs/%Y/%m/%d/access.log"
           ErrorLog    "|/usr/sbin/cronolog /www/logs/%Y/%m/%d/errors.log"

   would instruct Apache to pipe its access and error log messages into separate copies of cronolog, which would create new log files each day in a directory hierarchy structured by date, i.e. on  31  December
   1996 messages would be written to

           /www/logs/1996/12/31/access.log
           /www/logs/1996/12/31/errors.log

   after midnight the files

           /www/logs/1997/01/01/access.log
           /www/logs/1997/01/01/errors.log

而時間的格式是使用strftime function，不過根據介紹，基本能看懂，%是說明符，H代表0-23小時，24小時制，如此類推

Template format
   Each  character  in  the template represents a character in the expanded filename, except for date and time format specifiers, which are replaced by their expansion.  Format specifiers consist of a ‘%’ fol-
   lowed by one of the following characters:

   %      a literal % character

   n      a new-line character

   t      a horizontal tab character

   Time fields:

   H      hour (00..23)

   I      hour (01..12)

   p      the locale’s AM or PM indicator

   M      minute (00..59)

   S      second (00..61, which allows for leap seconds)

   X      the locale’s time representation (e.g.: "15:12:47")

   Z      time zone (e.g. GMT), or nothing if the time zone cannot be determined

   Date fields:

   a      the locale’s abbreviated weekday name (e.g.: Sun..Sat)

   A      the locale’s full weekday name (e.g.: Sunday .. Saturday)

   b      the locale’s abbreviated month name (e.g.: Jan .. Dec)

   B      the locale’s full month name, (e.g.: January .. December)

   c      the locale’s date and time (e.g.: "Sun Dec 15 14:12:47 GMT 1996")

   d      day of month (01 .. 31)

   j      day of year (001 .. 366)

   m      month (01 .. 12)

   U      week of the year with Sunday as first day of week (00..53, where week 1 is the week containing the first Sunday of the year)

   W      week of the year with Monday as first day of week (00..53, where week 1 is the week containing the first Monday of the year)

   w      day of week (0 .. 6, where 0 corresponds to Sunday)

   x      locale’s date representation (e.g. today in April in Britain: "13/04/97")

   y      year without the century (00 .. 99)

   Y      year with the century (1970 .. 2038)

   Other specifiers may be available depending on the C library’s implementation of the strftime function.

原文鏈接：http://www.godblessyuan.com/2015/02/15/apache_cronolog_log_split_rollback/