[root@rH7-1 ~]# cat /var/log/secure Jan  3 20:39:18 rH7-1 sshd[10878]: Accepted password for lczmx from 192.168.255.1 port 19375 ssh2

 # 在/etc/rsyslog.conf中加入 *.*                                     /var/log/all.log  # 在/var/log下创建all.log touch all.log  # 用ssh登录到该主机，然后查看日志，假如没有信息，可以restart一下rsyslog.service  grep "sshd" /var/log/all.log   Jan  5 13:28:26 rH7-1 sshd[10428]: Received disconnect from 192.168.255.1 port 2226:11: disconnected by user Jan  5 13:28:26 rH7-1 sshd[10428]: Disconnected from 192.168.255.1 port 2226 Jan  5 13:28:26 rH7-1 sshd[10424]: pam_unix(sshd:session): session closed for user lczmx Jan  5 13:28:29 rH7-1 sshd[10562]: Accepted password for lczmx from 192.168.255.1 port 2248 ssh2 Jan  5 13:28:30 rH7-1 sshd[10562]: pam_unix(sshd:session): session opened for user lczmx by (uid=0) 

# see "man logrotate" for details # rotate log files weekly 每周对日志进性一次轮替 weekly  # keep 4 weeks worth of backlogs 保存多少份 rotate 4  # create new (empty) log files after rotating old ones 在日志轮替后，创建新的空的日志文件 create  # use date as a suffix of the rotated file 使用日期作为日志轮替文件后缀 dateext  # uncomment this if you want your log files compressed 日志文件是否压缩，不注释即为压缩 #compress  # RPM packages drop log rotation information into this directory # 下面是配置某个日志文件，可以写在这里，也可以写在/etc/logrotate.d  include /etc/logrotate.d  # no packages own wtmp and btmp -- we'll rotate them here /var/log/wtmp {     monthly     create 0664 root utmp # 664权限，所有者：root，所属组：utmp 	minsize 1M	# 文件最小轮替大小     rotate 1	# 仅保留一份 }  /var/log/btmp {     missingok	# 日志不存在则忽略     monthly     create 0600 root utmp     rotate 1 }  # system-specific logs may be also be configured here. 

#!/bin/sh  /usr/sbin/logrotate -s /var/lib/logrotate/logrotate.status /etc/logrotate.conf EXITVALUE=$? if [ $EXITVALUE != 0 ]; then     /usr/bin/logger -t logrotate "ALERT exited abnormally with [$EXITVALUE]" fi exit 0