LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 06-19-2009, 06:59 AM   #1
musclehead
LQ Newbie
 
Registered: Jul 2007
Posts: 11

Rep: Reputation: 0
Logrotate weird behavior


I'm running FC 10 and have rsyslog receiving logs from an external server successfully.

I added a config in the /etc/logrotate.conf to rotate those logs daily and create a new log:

Code:
/var/log/mylog/*.log {
        daily
        create 0664 root root
        rotate 2
}
The log rotates properly, creating the previous days log w/ a YYYYMMDD extension (i.e. info.log-20090619). The actual log file (info.log) is empty and not receiving log messages. The latest log file (info.log-20090619) is instead appending with the log messages. I can't figure out why this would be - any ideas?!?!?
 
Old 06-19-2009, 07:22 AM   #2
kenneho
Member
 
Registered: May 2003
Location: Oslo, Norway
Distribution: Ubuntu, Red Hat Enterprise Linux
Posts: 655

Rep: Reputation: 40
I thinke the problem is that when logrotate rotate the file, it creates a new file and simply renames the old one. The old file, thus with the old inode, will still be written to as long as the application doesn't reopen the file. So in other words, as long as the application isn't told otherwise, it will continue to write to the same inode forever.

You can do one of two things: 1) Make sure the application closes and opens connection to the file (this is what the "kill -HUP" signal often is used for), or 2) use the notruncate option (or whatever it it called again) in logrotate.

EDIT: "copytruncate" is the option looking for.

Regards,
kenneho

Last edited by kenneho; 06-19-2009 at 07:32 AM.
 
Old 06-19-2009, 07:41 AM   #3
musclehead
LQ Newbie
 
Registered: Jul 2007
Posts: 11

Original Poster
Rep: Reputation: 0
thanks kenneho - that is something I was looking at.

However, what PID would I kill to effectively restart the service - rsyslog? The external logs are configured thru the rsyslog.conf file. Should I kill the rsyslog PID?

This is what I see for processes...

Code:
#ps -aux | grep rsyslog
root     19809  0.0  0.0  44696  1624 ?        Sl   Jun17   0:14 rsyslogd -c 3
I'm going to try the copytruncate command - see how that works...find out tomorrow morning! Thanks again!

Last edited by musclehead; 06-19-2009 at 07:45 AM.
 
Old 06-19-2009, 08:14 AM   #4
kenneho
Member
 
Registered: May 2003
Location: Oslo, Norway
Distribution: Ubuntu, Red Hat Enterprise Linux
Posts: 655

Rep: Reputation: 40
Quote:
Originally Posted by musclehead View Post
thanks kenneho - that is something I was looking at.

However, what PID would I kill to effectively restart the service - rsyslog? The external logs are configured thru the rsyslog.conf file. Should I kill the rsyslog PID?

This is what I see for processes...

Code:
#ps -aux | grep rsyslog
root     19809  0.0  0.0  44696  1624 ?        Sl   Jun17   0:14 rsyslogd -c 3
I'm going to try the copytruncate command - see how that works...find out tomorrow morning! Thanks again!
Take a look in /etc/logrorate.d/syslog - you've probably allready got a line for rsyslog there. If you need to rotate other logs, you can either enter them there or use the HUP-syntax in another config file.
 
Old 06-19-2009, 09:54 AM   #5
musclehead
LQ Newbie
 
Registered: Jul 2007
Posts: 11

Original Poster
Rep: Reputation: 0
I'm giving this a shot in my logrotate.conf file - we'll see. Thanks again!

Code:
/var/log/info/*.log {
    daily
    rotate 1
    sharedscripts
    postrotate
        /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
    endscript
}
 
Old 06-19-2009, 11:57 AM   #6
kenneho
Member
 
Registered: May 2003
Location: Oslo, Norway
Distribution: Ubuntu, Red Hat Enterprise Linux
Posts: 655

Rep: Reputation: 40
Quote:
Originally Posted by musclehead View Post
I'm giving this a shot in my logrotate.conf file - we'll see. Thanks again!

Code:
/var/log/info/*.log {
    daily
    rotate 1
    sharedscripts
    postrotate
        /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
    endscript
}
Shouldn't that be "rsyslogd.pid", and not plain "syslogd.pid"? Btw, you can issue the "logrotate" command with the path to your config file added, to test your setup now. And you can add the "-v" flag and/or "-f" flag if you want to.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Weird behavior!! surfer41 Linux - Networking 1 04-25-2006 07:53 AM
Weird behavior Bassy Linux - Software 2 10-20-2005 01:32 PM
weird mount behavior sohmc Linux - Hardware 0 06-07-2005 07:06 AM
Weird Behavior in KDE 3.3 haldara Linux - Newbie 3 09-24-2004 10:59 AM
Weird Knode behavior PapaNoHair Mandriva 0 11-09-2003 06:39 PM


All times are GMT -5. The time now is 01:26 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration