[20190305]删除审计登录信息不适合使用logrotate.txt
--//生产系统数据库sys用户登录会在/u01/app/oracle/admin/${ORACLE_SID}/adump/目录产生大量的后者为aud的文件.
--//比如生产系统:
# ls -1 /u01/app/oracle/admin/xxxx/adump/*_20190304*.aud |wc
612 612 45900
*/
# ls -ltr /u01/app/oracle/admin/xxxx/adump/*_20190305*.aud |tail
-rw-r----- 1 oracle asmadmin 871 2019-03-05 10:55:53 /u01/app/oracle/admin/xxxx/adump/xxxx1_ora_27361_20190305105553273305143795.aud
-rw-r----- 1 oracle asmadmin 880 2019-03-05 11:00:01 /u01/app/oracle/admin/xxxx/adump/xxxx1_ora_36802_20190305110001396547143795.aud
-rw-r----- 1 oracle asmadmin 870 2019-03-05 11:00:53 /u01/app/oracle/admin/xxxx/adump/xxxx1_ora_38839_20190305110053402074143795.aud
-rw-r----- 1 oracle asmadmin 870 2019-03-05 11:00:53 /u01/app/oracle/admin/xxxx/adump/xxxx1_ora_38835_20190305110053357991143795.aud
-rw-r----- 1 oracle asmadmin 880 2019-03-05 11:05:01 /u01/app/oracle/admin/xxxx/adump/xxxx1_ora_48024_20190305110501464621143795.aud
-rw-r----- 1 oracle asmadmin 870 2019-03-05 11:05:53 /u01/app/oracle/admin/xxxx/adump/xxxx1_ora_49658_20190305110553480183143795.aud
-rw-r----- 1 oracle asmadmin 870 2019-03-05 11:05:53 /u01/app/oracle/admin/xxxx/adump/xxxx1_ora_49654_20190305110553432700143795.aud
-rw-r----- 1 oracle asmadmin 880 2019-03-05 11:10:01 /u01/app/oracle/admin/xxxx/adump/xxxx1_ora_59474_20190305111001520453143795.aud
-rw-r----- 1 oracle asmadmin 871 2019-03-05 11:10:53 /u01/app/oracle/admin/xxxx/adump/xxxx1_ora_60887_20190305111053528155143795.aud
-rw-r----- 1 oracle asmadmin 871 2019-03-05 11:10:53 /u01/app/oracle/admin/xxxx/adump/xxxx1_ora_60885_20190305111053501151143795.aud
--//平均一天有接近600次sys用登录.主要是oem每隔5分钟检测数据库状态,每次发起3个连接,大量连接导致在这个目录产生大量的垃圾文件 */
--//我以前一直使用logrotate管理这些日志,但是在11g下存在如下问题.
--//11g下改变了文件命名格式加入时间戳,这样每个生成的文件是唯一的,这样state file(缺省是/var/lib/logrotate.status),会越滚越大.
--//这样每次执行越来越慢.10g下没有时间戳,也就是最大65XXX个文件(至少是一个定数).
--//logrotate配置如下:
/u01/app/oracle/admin/xxxx/adump/xxxx1_ora_*.aud
{
monthly
rotate 0
notifempty
missingok
nomail
# maxage 100
}
# ls -lh /var/lib/logrotate.status
-rw-r--r-- 1 root root 72M 2019-03-03 12:18:59 /var/lib/logrotate.status
--//已经72M.注意看/var/lib/logrotate.status时间戳,3月3号执行到12:18:59结束.
--//不知道还有什么好方法,要么使用find+cron的方式,要么采用链接http://blog.itpub.net/267265/viewspace-2139283/=>[20170518]11G审计日志清除3.txt
--//另外补充logrotate的调式技巧以及注意细节:
1.注意参数sharedscripts,不然每匹配一行都要执行1次.
# man logrotate
sharedscripts
Normally, prescript and postscript scripts are run for each log which is rotated and the absolute path to the log
file is passed as first argument to the script. That means a single script may be run multiple times for log file
entries which match multiple files (such as the /var/log/news/* example). If sharedscripts is specified, the
scripts are only run once, no matter how many logs match the wildcarded pattern, and whole pattern is passed to
them. However, if none of the logs in the pattern require rotating, the scripts will not be run at all. This
option overrides the nosharedscripts option and implies create option.
2.logrotate的调试:
--//使用参数-v -d ,-d仅仅调试不会真真执行.
--//加上-f比较特殊.
-f, --force
Tells logrotate to force the rotation, even if it doesn't think this is necessary. Sometimes this is useful after
adding new entries to logrotate, or if old log files have been removed by hand, as the new files will be created,and
logging will continue correctly.