[root@hf-01 ~]#
[root@hf-01 ~]# ls /var/log/messages
/var/log/messages
[root@hf-01 ~]# less !$
less /var/log/messages
[root@hf-01 ~]# du -sh !$
du -sh /var/log/messages
388K /var/log/messages
[root@hf-01 ~]# ls /var/log/messages*
/var/log/messages /var/log/messages-20171120 /var/log/messages-20171203
/var/log/messages-20171112 /var/log/messages-20171127
[root@hf-01 ~]#
[root@hf-01 ~]# cat /etc/logrotate.conf
# see "man logrotate" for details //会告诉你查看logrotate的帮助文档
# rotate log files weekly
weekly //每周切割一次
# keep 4 weeks worth of backlogs
rotate 4 //切割四个
# create new (empty) log files after rotating old ones
create //创建一个新的文件
# use date as a suffix of the rotated file
dateext //这是它的后缀名
# uncomment this if you want your log files compressed
#compress //是否需要压缩,压缩成 .tar.gz
# RPM packages drop log rotation information into this directory
include /etc/logrotate.d //这个目录下还有一些文件
# no packages own wtmp and btmp -- we'll rotate them here
/var/log/wtmp { //切割该文件,每个月切割一次
monthly
create 0664 root utmp
minsize 1M
rotate 1
}
/var/log/btmp { //切割该文件,指定权限,属主,属组
missingok
monthly
create 0600 root utmp
rotate 1
}
# system-specific logs may be also be configured here.
[root@hf-01 ~]#
[root@hf-01 ~]# ls /etc/logrotate.d
ppp samba syslog wpa_supplicant yum
[root@hf-01 ~]# cat /etc/logrotate.d/syslog
/var/log/cron
/var/log/maillog
/var/log/messages
/var/log/secure
/var/log/spooler
{
sharedscripts
postrotate
/bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
endscript
}
[root@hf-01 ~]#
[root@hf-01 ~]# last
root pts/0 192.168.74.1 Thu Dec 7 01:41 still logged in
reboot system boot 3.10.0-123.el7.x Thu Dec 7 01:36 - 05:38 (04:01)
root pts/1 192.168.74.1 Wed Dec 6 05:11 - 05:13 (00:01)
root pts/0 192.168.74.1 Wed Dec 6 01:27 - crash (1+00:09)
reboot system boot 3.10.0-123.el7.x Wed Dec 6 01:26 - 05:38 (1+04:11)
root pts/0 192.168.74.1 Tue Dec 5 01:38 - crash (23:48)
reboot system boot 3.10.0-123.el7.x Tue Dec 5 01:37 - 05:38 (2+04:00)
root pts/0 192.168.74.1 Mon Dec 4 03:23 - down (02:57)
root pts/0 192.168.74.1 Sun Dec 3 17:42 - 03:23 (09:40)
等等等,只截取了一部分
[root@hf-01 ~]# ls /var/log/wtmp
/var/log/wtmp
[root@hf-01 ~]# lastb
btmp begins Sat Dec 2 04:25:01 2017
[root@hf-01 ~]# ls /var/log/btmp
/var/log/btmp
[root@hf-01 ~]#
[root@hf-01 ~]# ls /var/log/secure
/var/log/secure
[root@hf-01 ~]#