在對(duì)某客戶VCSA進(jìn)行巡檢時(shí)發(fā)現(xiàn)日志存儲(chǔ)分區(qū)磁盤空間已經(jīng)占滿，在進(jìn)一步的檢查中發(fā)現(xiàn)analytics-runtime.log.stderr日志體積已經(jīng)超過6GB，為留足充分觀察與判斷故障的時(shí)間，臨時(shí)為日志分區(qū)進(jìn)行了5GB的磁盤空間擴(kuò)容，經(jīng)過3天的觀察，日志體積超過7GB，平均一天超過300MB的增長速度。

經(jīng)過我們工程師的專業(yè)處置，先已成功降低該日志文件體積，實(shí)現(xiàn)日志輪轉(zhuǎn)，方法如下：

新建文件vmware-analytics.lr：

vi /etc/logrotate.d/vmware-analytics.lr

保存以下內(nèi)容至文件：

/var/log/vmware/analytics/analytics-runtime.log.stderr
/var/log/vmware/analytics/analytics-runtime.log.stdout
{
    size 1k
    nodateext
    rotate 10
    missingok
    notifempty
    compress
    copytruncate
    nocreate
    postrotate
       /usr/sbin/vmon-cli -r analytics -c /storage/vmware-vmon/vmonserver > /dev/null

       #In rare cases timing issue occurs where the file is written with the previous offset and this fills log-0 instead of trucating it
       #Logrotate moves log-0.stderr in log-1.stderr and compresses it before that
       filestderr=/var/log/vmware/analytics/analytics-runtime.log-0.stderr
       if [ -n "$(find $filestderr -prune -size +1000c)" ]; then
           echo "Truncating $filestderr"
           >$filestderr
       fi
    endscript
}

按esc退出編輯模式，然后輸入:wq保存退出即可。

參考KB

https://kb.vmware.com/s/article/85468