feat: improve host log management (#13345)

ssongliu · web-flow · commit 7f450544e14d · 2026-07-23T14:53:26.000+08:00
diff --git a/agent/app/api/v2/ssh.go b/agent/app/api/v2/ssh.go
@@ -224,6 +224,21 @@ func (b *BaseApi) ExportSSHLogs(c *gin.Context) {
 	helper.SuccessWithData(c, tmpFile)
 }
 
+// @Tags SSH
+// @Summary Clean host SSH logs
+// @Success 200
+// @Security ApiKeyAuth
+// @Security Timestamp
+// @Router /hosts/ssh/log/clean [post]
+// @x-panel-log {"bodyKeys":[],"paramKeys":[],"BeforeFunctions":[],"formatZH":"清空 SSH 登录日志","formatEN":"clean SSH login logs"}
+func (b *BaseApi) CleanSSHLogs(c *gin.Context) {
+	if err := sshService.CleanLog(); err != nil {
+		helper.InternalServer(c, err)
+		return
+	}
+	helper.Success(c)
+}
+
 // @Tags SSH
 // @Summary Load host SSH conf
 // @Accept json
diff --git a/agent/app/dto/logs.go b/agent/app/dto/logs.go
@@ -36,6 +36,7 @@ type SystemLogRes struct {
 
 type SystemLogItem struct {
 	Timestamp int64  `json:"-"`
+	Cursor    string `json:"-"`
 	Time      string `json:"time"`
 	Priority  string `json:"priority"`
 	Service   string `json:"service"`
diff --git a/agent/app/service/logs.go b/agent/app/service/logs.go
@@ -33,8 +33,9 @@ var (
 )
 
 type systemLogCursor struct {
-	EndTime int64 `json:"endTime"`
-	Skipped int   `json:"skipped"`
+	EndTime       int64  `json:"endTime"`
+	Skipped       int    `json:"skipped"`
+	JournalCursor string `json:"journalCursor,omitempty"`
 }
 
 type ILogService interface {
@@ -61,32 +62,14 @@ func (u *LogService) ReadSystemLog(req dto.SystemLogReq) (dto.SystemLogRes, erro
 	if err != nil {
 		return dto.SystemLogRes{}, err
 	}
-	if cursor != nil {
+	if cursor != nil && cursor.JournalCursor == "" {
 		endTime = time.Unix(0, cursor.EndTime*int64(time.Microsecond))
 	}
 	journalctl, err := exec.LookPath("journalctl")
 	if err != nil {
 		return u.readFileSystemLog(req, startTime, endTime, pageSize, cursor)
 	}
-	args := []string{
-		"--no-pager", "--reverse", "--output=json",
-		"--since", formatJournalQueryTime(startTime),
-		"--until", formatJournalQueryTime(endTime),
-	}
-	if service := strings.TrimSpace(req.Service); service != "" {
-		args = append(args, "-u", service)
-	}
-	if priority := strings.TrimSpace(req.Priority); priority != "" {
-		args = append(args, "--priority", priority)
-	}
-	if keyword := strings.TrimSpace(req.Keyword); keyword != "" {
-		args = append(args, "--grep", keyword)
-	}
-	queryLines := pageSize + 1
-	if cursor != nil {
-		queryLines += cursor.Skipped
-	}
-	queryArgs := append(args, "--lines="+strconv.Itoa(queryLines))
+	queryArgs := buildJournalQueryArgs(req, startTime, endTime, pageSize, cursor)
 	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
 	output, err := exec.CommandContext(ctx, journalctl, queryArgs...).CombinedOutput()
 	cancel()
@@ -98,7 +81,7 @@ func (u *LogService) ReadSystemLog(req dto.SystemLogReq) (dto.SystemLogRes, erro
 		return dto.SystemLogRes{Source: "journalctl", Items: []dto.SystemLogItem{}}, nil
 	}
 	items := parseJournalLogItems(content)
-	if cursor != nil {
+	if cursor != nil && cursor.JournalCursor == "" {
 		items, err = skipSystemLogCursorItems(items, *cursor)
 		if err != nil {
 			return dto.SystemLogRes{}, err
@@ -107,6 +90,32 @@ func (u *LogService) ReadSystemLog(req dto.SystemLogReq) (dto.SystemLogRes, erro
 	return buildSystemLogResponse("journalctl", items, pageSize, cursor)
 }
 
+func buildJournalQueryArgs(req dto.SystemLogReq, startTime, endTime time.Time, pageSize int, cursor *systemLogCursor) []string {
+	args := []string{
+		"--no-pager", "--reverse", "--output=json",
+		"--since", formatJournalQueryTime(startTime),
+	}
+	if cursor != nil && cursor.JournalCursor != "" {
+		args = append(args, "--after-cursor="+cursor.JournalCursor)
+	} else {
+		args = append(args, "--until", formatJournalQueryTime(endTime))
+	}
+	if service := strings.TrimSpace(req.Service); service != "" {
+		args = append(args, "-u", service)
+	}
+	if priority := strings.TrimSpace(req.Priority); priority != "" {
+		args = append(args, "--priority", priority)
+	}
+	if keyword := strings.TrimSpace(req.Keyword); keyword != "" {
+		args = append(args, "--grep", keyword)
+	}
+	queryLines := pageSize + 1
+	if cursor != nil && cursor.JournalCursor == "" {
+		queryLines += cursor.Skipped
+	}
+	return append(args, "--lines="+strconv.Itoa(queryLines))
+}
+
 func (u *LogService) readFileSystemLog(req dto.SystemLogReq, startTime, endTime time.Time, pageSize int, cursor *systemLogCursor) (dto.SystemLogRes, error) {
 	items := make([]dto.SystemLogItem, 0)
 	for _, logFile := range []string{"/var/log/syslog", "/var/log/messages", "/var/log/system.log"} {
@@ -156,11 +165,16 @@ func buildSystemLogResponse(source string, items []dto.SystemLogItem, pageSize i
 		return res, nil
 	}
 	lastItem := items[len(items)-1]
-	skipped := countSystemLogTimestamp(items, lastItem.Timestamp)
-	if cursor != nil && cursor.EndTime == lastItem.Timestamp {
-		skipped += cursor.Skipped
+	next := systemLogCursor{EndTime: lastItem.Timestamp}
+	if lastItem.Cursor != "" {
+		next.JournalCursor = lastItem.Cursor
+	} else {
+		next.Skipped = countSystemLogTimestamp(items, lastItem.Timestamp)
+		if cursor != nil && cursor.EndTime == lastItem.Timestamp {
+			next.Skipped += cursor.Skipped
+		}
 	}
-	nextCursor, err := encodeSystemLogCursor(systemLogCursor{EndTime: lastItem.Timestamp, Skipped: skipped})
+	nextCursor, err := encodeSystemLogCursor(next)
 	if err != nil {
 		return dto.SystemLogRes{}, err
 	}
@@ -215,7 +229,8 @@ func countSystemLogTimestamp(items []dto.SystemLogItem, timestamp int64) int {
 }
 
 func formatJournalQueryTime(value time.Time) string {
-	return value.In(time.Local).Format("2006-01-02 15:04:05.000000")
+	// Fractional seconds are rejected by some journalctl versions.
+	return value.In(time.Local).Format("2006-01-02 15:04:05")
 }
 
 func parseFileSystemLogItem(line string) (dto.SystemLogItem, bool) {
@@ -358,6 +373,7 @@ func parseJournalLogItems(content string) []dto.SystemLogItem {
 		}
 		items = append(items, dto.SystemLogItem{
 			Timestamp: journalFieldMicroseconds(fields),
+			Cursor:    journalFieldString(fields, "__CURSOR"),
 			Time:      formatJournalTimestamp(journalFieldString(fields, "__REALTIME_TIMESTAMP")),
 			Priority:  journalFieldString(fields, "PRIORITY"),
 			Service:   journalFieldString(fields, "_SYSTEMD_UNIT"),
diff --git a/agent/app/service/ssh.go b/agent/app/service/ssh.go
@@ -52,6 +52,7 @@ type ISSHService interface {
 
 	LoadLog(ctx *gin.Context, req dto.SearchSSHLog) (int64, []dto.SSHHistory, error)
 	ExportLog(ctx *gin.Context, req dto.SearchSSHLog) (string, error)
+	CleanLog() error
 
 	SyncRootCert() error
 	CreateRootCert(req dto.RootCertOperate) error
@@ -658,6 +659,15 @@ type sshFileItem struct {
 	Year int
 }
 
+func isSSHLogFileName(name string) bool {
+	for _, baseName := range []string{"auth.log", "secure"} {
+		if name == baseName || strings.HasPrefix(name, baseName+".") || strings.HasPrefix(name, baseName+"-") {
+			return true
+		}
+	}
+	return false
+}
+
 func (u *SSHService) LoadLog(ctx *gin.Context, req dto.SearchSSHLog) (int64, []dto.SSHHistory, error) {
 	var fileList []sshFileItem
 	var data []dto.SSHHistory
@@ -667,10 +677,16 @@ func (u *SSHService) LoadLog(ctx *gin.Context, req dto.SearchSSHLog) (int64, []d
 		return 0, data, err
 	}
 	for _, item := range fileItems {
-		if item.IsDir() || (!strings.HasPrefix(item.Name(), "secure") && !strings.HasPrefix(item.Name(), "auth.log")) {
+		if item.IsDir() || !isSSHLogFileName(item.Name()) {
+			continue
+		}
+		info, err := item.Info()
+		if err != nil {
+			return 0, data, err
+		}
+		if !info.Mode().IsRegular() {
 			continue
 		}
-		info, _ := item.Info()
 		itemPath := path.Join(baseDir, info.Name())
 		if strings.HasSuffix(itemPath, ".gz") {
 			if _, err := os.Stat(strings.TrimSuffix(itemPath, ".gz")); err == nil {
@@ -725,6 +741,41 @@ func (u *SSHService) LoadLog(ctx *gin.Context, req dto.SearchSSHLog) (int64, []d
 	return int64(total), data, nil
 }
 
+func (u *SSHService) CleanLog() error {
+	return cleanSSHLogFiles("/var/log")
+}
+
+func cleanSSHLogFiles(baseDir string) error {
+	fileItems, err := os.ReadDir(baseDir)
+	if err != nil {
+		return err
+	}
+	for _, item := range fileItems {
+		if item.IsDir() || !isSSHLogFileName(item.Name()) {
+			continue
+		}
+		info, err := item.Info()
+		if err != nil {
+			return err
+		}
+		if !info.Mode().IsRegular() {
+			continue
+		}
+
+		itemPath := path.Join(baseDir, item.Name())
+		if item.Name() == "auth.log" || item.Name() == "secure" {
+			if err := os.Truncate(itemPath, 0); err != nil {
+				return err
+			}
+			continue
+		}
+		if err := os.Remove(itemPath); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
 func (u *SSHService) ExportLog(ctx *gin.Context, req dto.SearchSSHLog) (string, error) {
 	_, logs, err := u.LoadLog(ctx, req)
 	if err != nil {
diff --git a/agent/cmd/server/docs/x-log.json b/agent/cmd/server/docs/x-log.json
@@ -3609,6 +3609,13 @@
 		"formatZH": "修改 SSH 配置文件 [key]",
 		"formatEN": "update SSH conf [key]"
 	},
+	"/hosts/ssh/log/clean": {
+		"bodyKeys": [],
+		"paramKeys": [],
+		"beforeFunctions": [],
+		"formatZH": "清空 SSH 登录日志",
+		"formatEN": "clean SSH login logs"
+	},
 	"/hosts/ssh/operate": {
 		"bodyKeys": [
 			"operation"
diff --git a/agent/router/ro_host.go b/agent/router/ro_host.go
@@ -49,6 +49,7 @@ func (s *HostRouter) InitRouter(Router *gin.RouterGroup) {
 		hostRouter.POST("/ssh/update", baseApi.UpdateSSH)
 		hostRouter.POST("/ssh/log", baseApi.LoadSSHLogs)
 		hostRouter.POST("/ssh/log/export", baseApi.ExportSSHLogs)
+		hostRouter.POST("/ssh/log/clean", baseApi.CleanSSHLogs)
 		hostRouter.POST("/ssh/operate", baseApi.OperateSSH)
 		hostRouter.POST("/ssh/file", baseApi.LoadSSHFile)
 		hostRouter.POST("/ssh/file/update", baseApi.UpdateSSHByFile)
diff --git a/core/cmd/server/docs/docs.go b/core/cmd/server/docs/docs.go
@@ -19445,6 +19445,34 @@ const docTemplate = `{
 				]
 			}
 		},
+		"/hosts/ssh/log/clean": {
+			"post": {
+				"responses": {
+					"200": {
+						"description": "OK"
+					}
+				},
+				"security": [
+					{
+						"ApiKeyAuth": []
+					},
+					{
+						"Timestamp": []
+					}
+				],
+				"summary": "Clean host SSH logs",
+				"tags": [
+					"SSH"
+				],
+				"x-panel-log": {
+					"BeforeFunctions": [],
+					"bodyKeys": [],
+					"formatEN": "clean SSH login logs",
+					"formatZH": "清空 SSH 登录日志",
+					"paramKeys": []
+				}
+			}
+		},
 		"/hosts/ssh/log/export": {
 			"post": {
 				"consumes": [
@@ -46537,4 +46565,4 @@ var SwaggerInfo = &swag.Spec{
 
 func init() {
 	swag.Register(SwaggerInfo.InstanceName(), SwaggerInfo)
-}
+}
diff --git a/core/cmd/server/docs/swagger.json b/core/cmd/server/docs/swagger.json
@@ -19441,6 +19441,34 @@
 				]
 			}
 		},
+		"/hosts/ssh/log/clean": {
+			"post": {
+				"responses": {
+					"200": {
+						"description": "OK"
+					}
+				},
+				"security": [
+					{
+						"ApiKeyAuth": []
+					},
+					{
+						"Timestamp": []
+					}
+				],
+				"summary": "Clean host SSH logs",
+				"tags": [
+					"SSH"
+				],
+				"x-panel-log": {
+					"BeforeFunctions": [],
+					"bodyKeys": [],
+					"formatEN": "clean SSH login logs",
+					"formatZH": "清空 SSH 登录日志",
+					"paramKeys": []
+				}
+			}
+		},
 		"/hosts/ssh/log/export": {
 			"post": {
 				"consumes": [
@@ -46516,4 +46544,4 @@
 			"type": "object"
 		}
 	}
-}
+}
diff --git a/core/cmd/server/docs/x-log.json b/core/cmd/server/docs/x-log.json
@@ -3609,6 +3609,13 @@
 		"formatZH": "修改 SSH 配置文件 [key]",
 		"formatEN": "update SSH conf [key]"
 	},
+	"/hosts/ssh/log/clean": {
+		"bodyKeys": [],
+		"paramKeys": [],
+		"beforeFunctions": [],
+		"formatZH": "清空 SSH 登录日志",
+		"formatEN": "clean SSH login logs"
+	},
 	"/hosts/ssh/operate": {
 		"bodyKeys": [
 			"operation"
diff --git a/frontend/src/api/modules/host.ts b/frontend/src/api/modules/host.ts
@@ -200,6 +200,9 @@ export const loadSSHLogs = (params: Host.searchSSHLog, currentNode?: string) =>
 export const exportSSHLogs = (params: Host.searchSSHLog) => {
     return http.post<string>(`/hosts/ssh/log/export`, params, TimeoutEnum.T_40S);
 };
+export const cleanSSHLogs = () => {
+    return http.post(`/hosts/ssh/log/clean`, {});
+};
 
 export const listDisks = () => {
     return http.get<Host.CompleteDiskInfo>(`/hosts/disks`);
diff --git a/frontend/src/views/host/ssh/log/log.vue b/frontend/src/views/host/ssh/log/log.vue
