| suprstar |
02-23-2012 07:14 AM |
rsyslog and log rotate problem
I have an Ubuntu 10.0.4 LTS server running as my syslog server for all my devices that can use it.
in /etc/rsyslog.d/50-default.conf I added these lines at the top:
Code:
:msg, contains, "atl1-wichorus" /var/log/wic1.atl.log
:msg, contains, "atl2-wichorus" /var/log/wic2.atl.log
:msg, contains, "jax1-wichorus" /var/log/wic1.jax.log
:msg, contains, "jax2-wichorus" /var/log/wic2.jax.log
incoming messages are directed to the proper log files. The problem is when the files rotate - /var/log/wic1.atl.log becomes /var/log/wic1.atl.log.1 like it's supposed to, and a new 0-byte /var/log/wic1.atl.log is created. However, syslog writes new messages to the /var/log/wic1.atl.log.1 file. Since the new /var/log/wic1.atl.log is always 0 bytes, it never gets rotated again.
I have a file in /etc/logrotate.d that contains:
Code:
/var/log/wic*.log {
daily
missingok
rotate 8
compress
delaycompress
notifempty
create 640 root adm
endscript
postrotate
reload rsyslog >/dev/null 2>&1 || true
}
So these files only start writing to the new file if I restart syslog.
Code:
-rw-r----- 1 root adm 0 2012-02-16 04:37 wic1.atl.log
-rw-r----- 1 syslog adm 4936864679 2012-02-23 08:14 wic1.atl.log.1
-rw-r----- 1 syslog adm 35695955 2012-02-15 11:59 wic1.atl.log.2.gz
-rw-r----- 1 syslog adm 29216126 2012-02-14 08:31 wic1.atl.log.3.gz
-rw-r----- 1 syslog adm 174011677 2012-02-13 09:13 wic1.atl.log.4.gz
-rw-r----- 1 syslog adm 2426022 2012-02-08 11:01 wic1.atl.log.5.gz
-rw-r----- 1 syslog adm 24951368 2012-02-02 11:08 wic1.atl.log.6.gz
I even added "/etc/init.d/rsyslog restart" to the logrotate script, and that didn't work either! It does when I do it on a command line.. What am I missing here? |
