Logrotate weird behavior

musclehead · 06-19-2009, 06:59 AM

I'm running FC 10 and have rsyslog receiving logs from an external server successfully.

I added a config in the /etc/logrotate.conf to rotate those logs daily and create a new log:

Code:

/var/log/mylog/*.log {
        daily
        create 0664 root root
        rotate 2
}

The log rotates properly, creating the previous days log w/ a YYYYMMDD extension (i.e. info.log-20090619). The actual log file (info.log) is empty and not receiving log messages. The latest log file (info.log-20090619) is instead appending with the log messages. I can't figure out why this would be - any ideas?!?!?

kenneho · 06-19-2009, 07:22 AM

I thinke the problem is that when logrotate rotate the file, it creates a new file and simply renames the old one. The old file, thus with the old inode, will still be written to as long as the application doesn't reopen the file. So in other words, as long as the application isn't told otherwise, it will continue to write to the same inode forever.

You can do one of two things: 1) Make sure the application closes and opens connection to the file (this is what the "kill -HUP" signal often is used for), or 2) use the notruncate option (or whatever it it called again) in logrotate.

EDIT: "copytruncate" is the option looking for.

Regards,
kenneho

musclehead · 06-19-2009, 07:41 AM

thanks kenneho - that is something I was looking at.

However, what PID would I kill to effectively restart the service - rsyslog? The external logs are configured thru the rsyslog.conf file. Should I kill the rsyslog PID?

This is what I see for processes...

Code:

#ps -aux | grep rsyslog
root     19809  0.0  0.0  44696  1624 ?        Sl   Jun17   0:14 rsyslogd -c 3

I'm going to try the copytruncate command - see how that works...find out tomorrow morning! Thanks again!

kenneho · 06-19-2009, 08:14 AM

Quote:

Originally Posted by musclehead

thanks kenneho - that is something I was looking at.

However, what PID would I kill to effectively restart the service - rsyslog? The external logs are configured thru the rsyslog.conf file. Should I kill the rsyslog PID?

This is what I see for processes...

Code:

#ps -aux | grep rsyslog
root     19809  0.0  0.0  44696  1624 ?        Sl   Jun17   0:14 rsyslogd -c 3

I'm going to try the copytruncate command - see how that works...find out tomorrow morning! Thanks again!

Take a look in /etc/logrorate.d/syslog - you've probably allready got a line for rsyslog there. If you need to rotate other logs, you can either enter them there or use the HUP-syntax in another config file.

musclehead · 06-19-2009, 09:54 AM

I'm giving this a shot in my logrotate.conf file - we'll see. Thanks again!

Code:

/var/log/info/*.log {
    daily
    rotate 1
    sharedscripts
    postrotate
        /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
    endscript
}

kenneho · 06-19-2009, 11:57 AM

Quote:

Originally Posted by musclehead

I'm giving this a shot in my logrotate.conf file - we'll see. Thanks again!

Code:

/var/log/info/*.log {
    daily
    rotate 1
    sharedscripts
    postrotate
        /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
    endscript
}

Shouldn't that be "rsyslogd.pid", and not plain "syslogd.pid"? Btw, you can issue the "logrotate" command with the path to your config file added, to test your setup now. And you can add the "-v" flag and/or "-f" flag if you want to.