配置psacct并配置日志轮转

一、安装psacct

yum update
yum install psacct -y

二、启动psacct

systemctl start psacct
systemctl status psacct

三、查看是否起作用

lastcomm root -f /var/account/pacct

四、配置开机自启

1.配置service文件

vim /etc/systemd/system/pacct.service

[Unit]
Description=Process Accounting

[Service]
ExecStart=/sbin/service psacct start

[Install]
WantedBy=multi-user.target

2.加载并启用服务

systemctl daemon-reload
systemctl enable pacct.service

3.验证

systemctl start pacct.service
systemctl status psacct

正常启动则配置成功

五、配置日志轮转并清除旧日志

vim /etc/logrotate.d/psacct

/var/account/pacct {
compress
delaycompress
notifempty
daily
rotate 30
missingok
delaycompress
maxage 30
sharedscripts
postrotate
   /usr/sbin/service psacct restart > /dev/null
endscript
}

1. 其中/var/account/pacct是日志路径
2. compress压缩
3. delaycompress延迟到下次轮转才压缩
4. rotate 30保留最近30个日志文件副本
5. maxage 30保留最近30天的日志文件
6. sharedscripts轮转前后，共享脚本
7. postrotate轮转后执行的脚本
8. /usr/sbin/service psacct restart > /dev/null 轮转后重启
9. daily每天执行轮转操作
10. notifempty如果日志为空，则不轮转
11. missingok日志文件不存在，则继续执行轮转操作

六、验证配置

logrotate  -d /etc/logrotate.d/psacct