[SOLVED] rsyslog and log rotate problem

suprstar · 02-23-2012, 07:14 AM

I have an Ubuntu 10.0.4 LTS server running as my syslog server for all my devices that can use it.

in /etc/rsyslog.d/50-default.conf I added these lines at the top:

Code:

:msg, contains, "atl1-wichorus" /var/log/wic1.atl.log
:msg, contains, "atl2-wichorus" /var/log/wic2.atl.log
:msg, contains, "jax1-wichorus" /var/log/wic1.jax.log
:msg, contains, "jax2-wichorus" /var/log/wic2.jax.log

incoming messages are directed to the proper log files. The problem is when the files rotate - /var/log/wic1.atl.log becomes /var/log/wic1.atl.log.1 like it's supposed to, and a new 0-byte /var/log/wic1.atl.log is created. However, syslog writes new messages to the /var/log/wic1.atl.log.1 file. Since the new /var/log/wic1.atl.log is always 0 bytes, it never gets rotated again.

I have a file in /etc/logrotate.d that contains:

Code:

/var/log/wic*.log {
        daily
        missingok
        rotate 8
        compress
        delaycompress
        notifempty
        create 640 root adm
        endscript
        postrotate
                reload rsyslog >/dev/null 2>&1 || true

}

So these files only start writing to the new file if I restart syslog.

Code:

-rw-r-----  1 root      adm             0 2012-02-16 04:37 wic1.atl.log
-rw-r-----  1 syslog    adm    4936864679 2012-02-23 08:14 wic1.atl.log.1
-rw-r-----  1 syslog    adm      35695955 2012-02-15 11:59 wic1.atl.log.2.gz
-rw-r-----  1 syslog    adm      29216126 2012-02-14 08:31 wic1.atl.log.3.gz
-rw-r-----  1 syslog    adm     174011677 2012-02-13 09:13 wic1.atl.log.4.gz
-rw-r-----  1 syslog    adm       2426022 2012-02-08 11:01 wic1.atl.log.5.gz
-rw-r-----  1 syslog    adm      24951368 2012-02-02 11:08 wic1.atl.log.6.gz

I even added "/etc/init.d/rsyslog restart" to the logrotate script, and that didn't work either! It does when I do it on a command line.. What am I missing here?

pafoo · 02-23-2012, 11:37 AM

Take the * out of your logrotate conf file and specify each file to get rotated. See if that helps.

Reuti · 02-24-2012, 04:29 AM

The endscript is missing below the reload command (man logrotate). Also the “|| true” shouldn’t be necessary.

suprstar · 02-26-2012, 06:09 AM

Quote:

Originally Posted by Reuti

The endscript is missing below the reload command (man logrotate). Also the “|| true” shouldn’t be necessary.

That was it, the 'endscript' was in the middle of the config, not at the end. Thanks!