LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Newbie (https://www.linuxquestions.org/questions/linux-newbie-8/)
-   -   Logrotate weird behavior (https://www.linuxquestions.org/questions/linux-newbie-8/logrotate-weird-behavior-734162/)

musclehead 06-19-2009 06:59 AM
Logrotate weird behavior
 
I'm running FC 10 and have rsyslog receiving logs from an external server successfully.

I added a config in the /etc/logrotate.conf to rotate those logs daily and create a new log:

Code:
/var/log/mylog/*.log {
        daily
        create 0664 root root
        rotate 2
}
The log rotates properly, creating the previous days log w/ a YYYYMMDD extension (i.e. info.log-20090619). The actual log file (info.log) is empty and not receiving log messages. The latest log file (info.log-20090619) is instead appending with the log messages. I can't figure out why this would be - any ideas?!?!?

kenneho 06-19-2009 07:22 AM
I thinke the problem is that when logrotate rotate the file, it creates a new file and simply renames the old one. The old file, thus with the old inode, will still be written to as long as the application doesn't reopen the file. So in other words, as long as the application isn't told otherwise, it will continue to write to the same inode forever.

You can do one of two things: 1) Make sure the application closes and opens connection to the file (this is what the "kill -HUP" signal often is used for), or 2) use the notruncate option (or whatever it it called again) in logrotate.

EDIT: "copytruncate" is the option looking for.

Regards,
kenneho

musclehead 06-19-2009 07:41 AM
thanks kenneho - that is something I was looking at.

However, what PID would I kill to effectively restart the service - rsyslog? The external logs are configured thru the rsyslog.conf file. Should I kill the rsyslog PID?

This is what I see for processes...

Code:
#ps -aux | grep rsyslog
root    19809  0.0  0.0  44696  1624 ?        Sl  Jun17  0:14 rsyslogd -c 3
I'm going to try the copytruncate command - see how that works...find out tomorrow morning! Thanks again!

kenneho 06-19-2009 08:14 AM
Quote:
Originally Posted by musclehead (Post 3579565)
thanks kenneho - that is something I was looking at.

However, what PID would I kill to effectively restart the service - rsyslog? The external logs are configured thru the rsyslog.conf file. Should I kill the rsyslog PID?

This is what I see for processes...

Code:
#ps -aux | grep rsyslog
root    19809  0.0  0.0  44696  1624 ?        Sl  Jun17  0:14 rsyslogd -c 3
I'm going to try the copytruncate command - see how that works...find out tomorrow morning! Thanks again!
Take a look in /etc/logrorate.d/syslog - you've probably allready got a line for rsyslog there. If you need to rotate other logs, you can either enter them there or use the HUP-syntax in another config file.

musclehead 06-19-2009 09:54 AM
I'm giving this a shot in my logrotate.conf file - we'll see. Thanks again!

Code:
/var/log/info/*.log {
    daily
    rotate 1
    sharedscripts
    postrotate
        /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
    endscript
}

kenneho 06-19-2009 11:57 AM
Quote:
Originally Posted by musclehead (Post 3579673)
I'm giving this a shot in my logrotate.conf file - we'll see. Thanks again!

Code:
/var/log/info/*.log {
    daily
    rotate 1
    sharedscripts
    postrotate
        /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
    endscript
}
Shouldn't that be "rsyslogd.pid", and not plain "syslogd.pid"? Btw, you can issue the "logrotate" command with the path to your config file added, to test your setup now. And you can add the "-v" flag and/or "-f" flag if you want to.


All times are GMT -5. The time now is 04:41 PM.