logrotate 不压缩 /var/log/messages

随着时间的推移，我注意到一些日志，/var/log例如auth，kern并且messages变得越来越大。我logrotate为他们做了条目：

$ cat /etc/logrotate.d/auth.log 
/var/log/kern.log {
    rotate 5
    daily
}
$ cat /etc/logrotate.d/kern.log 
/var/log/kern.log {
    rotate 5
    daily
}
$ cat /etc/logrotate.d/messages 
/var/log/messages {
    rotate 5
    daily
    postrotate
        /bin/killall -HUP syslogd
    endscript
}

我也compress启用了该选项：

$ grep compress /etc/logrotate.conf 
# uncomment this if you want your log files compressed
compress

这适用于auth.log和kern.log其他人，这意味着这些日志中的每一个都被压缩和旋转，并保留了最后 5 天的日志。/var/log/messages但是没有被压缩，导致日志超过 5 天：

$ ls /var/log/messages*
/var/log/messages           /var/log/messages-20100213
/var/log/messages-20100201  /var/log/messages-20100214
/var/log/messages-20100202  /var/log/messages-20100215
/var/log/messages-20100203  /var/log/messages-20100216
/var/log/messages-20100204  /var/log/messages-20100217
/var/log/messages-20100205  /var/log/messages-20100218
/var/log/messages-20100206  /var/log/messages-20100219
/var/log/messages-20100207  /var/log/messages-20100220
/var/log/messages-20100208  /var/log/messages-20100221
/var/log/messages-20100209  /var/log/messages-20100222
/var/log/messages-20100210  /var/log/messages-20100223
/var/log/messages-20100211  /var/log/messages-20100224
/var/log/messages-20100212

正如在 ServerFault 上的另一个logrotate问题中所解释的那样，旧日志（很可能）不会被删除，因为每个文件的文件结尾不同。这似乎是因为文件没有被压缩。

我可以做些什么来/var/log/messages压缩和轮换保留最后 5 天的日志，就像我的所有其他日志文件一样？我错过了什么？

编辑1：前几个答案中要求的附加信息。

我正在运行 Gentoo Linux。我的/etc/logrotate.conf文件：

$ cat /etc/logrotate.conf 
# $Header: /var/cvsroot/gentoo-x86/app-admin/logrotate/files/logrotate.conf,v 1.3 2008/12/24 20:49:10 dang Exp $
#
# Logrotate default configuration file for Gentoo Linux
#
# See "man logrotate" for details
# rotate log files weekly
weekly
#daily
# keep 4 weeks worth of backlogs
rotate 4
# create new (empty) log files after rotating old ones
create
# use date as a suffix of the rotated file
dateext
# uncomment this if you want your log files compressed
compress
# packages can drop log rotation information into this directory
include /etc/logrotate.d
notifempty
nomail
noolddir
# no packages own lastlog or wtmp -- we'll rotate them here
/var/log/wtmp {
    monthly
    create 0664 root utmp
    rotate 1
}
/var/log/btmp {
    missingok
    monthly
    create 0600 root utmp
    rotate 1
}

/etc/logrotate.d包含我上面提到的自定义配置文件以及这些软件包安装的 mysql、rsync 等配置。

我的根crontab是空的：

$ sudo crontab -l
no crontab for root

我检查了所有/etc/cron.{daily,hourly,monthly,weekly}与 syslog 相关的内容，并且有一个脚本可以旋转/var/log/syslog和/var/log/auth.log.

接下来，我按照 CarpeNoctem 的建议制作了一个/var/log/messages-onlylogrotate配置文件：

$ cat logrotate-messages 
weekly
rotate 4
create
dateext
compress
notifempty
nomail
noolddir
/var/log/messages {
    rotate 5
    daily
    postrotate
        /bin/killall -HUP syslogd
    endscript
}

然后我logrotate手动运行：

$ logrotate -d logrotate-messages -f
reading config file logrotate-messages
reading config info for /var/log/messages 

Handling 1 logs

rotating pattern: /var/log/messages  forced from command line (5 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/messages
  log needs rotating
rotating log /var/log/messages, log->rotateCount is 5
dateext suffix '-20100224'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
glob finding old rotated logs failed
renaming /var/log/messages to /var/log/messages-20100224
creating new /var/log/messages mode = 0644 uid = 0 gid = 0
running postrotate script
running script with arg /var/log/messages : "
        /bin/killall -HUP syslogd
"
compressing log with: /bin/gzip
$ which gzip
/bin/gzip
$ file /bin/gzip
/bin/gzip: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.9, stripped

根据上面logrotate的日志，用 /bin/gzip 压缩了日志，但是在/var/log. 此外，旧旋转文件的通配失败。

编辑 2 ：在将后缀附加到旧文件logrotate后添加运行的调试输出。.gz/var/log/message-*

我们开始：

$ ls /var/log/messages*
/var/log/messages              /var/log/messages-20100222.gz
/var/log/messages-20100219.gz  /var/log/messages-20100223.gz
/var/log/messages-20100220.gz  /var/log/messages-20100224.gz
/var/log/messages-20100221.gz

然后logrotate使用我们的自定义配置文件运行：

$ logrotate -d logrotate-messages -f
reading config file logrotate-messages
reading config info for /var/log/messages 

Handling 1 logs

rotating pattern: /var/log/messages  forced from command line (5 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/messages
  log needs rotating
rotating log /var/log/messages, log->rotateCount is 5
dateext suffix '-20100224'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
removing /var/log/messages-20100219.gz
removing old log /var/log/messages-20100219.gz
destination /var/log/messages-20100224.gz already exists, skipping rotation

这一次，logrotate's glob 成功并找到了第六个压缩日志文件，打算将其删除。该文件实际上并未被删除；我想那是因为我们在调试模式下运行。

我很好奇启用该delaycompress选项是否/var/log/messages会有所帮助。我启用了它，第二天早上会检查结果。