LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices


Reply
  Search this Thread
Old 05-24-2013, 08:26 AM   #1
gr0undzer0
Member
 
Registered: Apr 2012
Location: Alexandria, VA
Distribution: Fedora
Posts: 46

Rep: Reputation: 1
logrotate and syslog rotation issues rhel6


I have the following logrotate configuration and its acting really strange. Logrotate does rotate the files but exits with an error every night and rsyslog continues to write to the old file for SOME of the logs. Its strange that maill log does get written to the new file but all the others don't. Unless I miss typed something this config should match exactly another rhel6 server I have. I can restart rsyslog manually though. With the exact same command and it works fine. I don't get it.

etc/logrotate.conf

weekly
rotate 4
create
include /etc/logrotate.d
/var/log/wtmp /var/log/btmp {
daily
rotate 7
create 0664 root utmp
}

/etc/logrotate.d/syslog

/var/log/messages /var/log/secure /var/log/maillog /var/log/spooler /var/log/boot.log /var/log/cron {
daily
rotate 7
sharedscripts
postrotate
service rsyslog restart
endscript
}

Last edited by gr0undzer0; 05-24-2013 at 08:53 AM.
 
Old 05-24-2013, 11:35 AM   #2
rtmistler
Moderator
 
Registered: Mar 2011
Location: USA
Distribution: MINT Debian, Angstrom, SUSE, Ubuntu, Debian
Posts: 9,055
Blog Entries: 13

Rep: Reputation: 4143Reputation: 4143Reputation: 4143Reputation: 4143Reputation: 4143Reputation: 4143Reputation: 4143Reputation: 4143Reputation: 4143Reputation: 4143Reputation: 4143
You can add criteria for file size and if you don't then it will choose a default that is probably stated in the manpage for logrotate. It will not always rotate a file if the file size doesn't match the criteria. However if you include force in the criteria, it will always rotate no matter the size of the file.

For size you would put in
Quote:
size 1M
or K depending on the maximum size log files you wish to allow.

The force option is when you invoke logrotate, not in the config by the way.

I'm not sure if it is cut/paste, or literal if there are no spaces to indent your postrotate options. I'm also not sure if that would be mandated. The examples in the man page indent the postrotate script lines 3 or 4 spaces. You may want to try that.

What error is it reporting? Or do you mean error is your interpretation when you're saying that it doesn't always rotate files?
 
1 members found this post helpful.
Old 05-24-2013, 11:38 AM   #3
gr0undzer0
Member
 
Registered: Apr 2012
Location: Alexandria, VA
Distribution: Fedora
Posts: 46

Original Poster
Rep: Reputation: 1
The file is created but rsyslog keeps writing to the old one.
 
Old 05-24-2013, 11:48 AM   #4
rtmistler
Moderator
 
Registered: Mar 2011
Location: USA
Distribution: MINT Debian, Angstrom, SUSE, Ubuntu, Debian
Posts: 9,055
Blog Entries: 13

Rep: Reputation: 4143Reputation: 4143Reputation: 4143Reputation: 4143Reputation: 4143Reputation: 4143Reputation: 4143Reputation: 4143Reputation: 4143Reputation: 4143Reputation: 4143
A backup is created, but the original is left alone, and when you restart rsyslog it merely continues that last file? If that's correct, then in your postrotate steps, remove the log file for rsyslog.

Logrotate shouldn't do that. Perhaps this is rsyslog doing this. I'm betting it is. How about a prerotate script which stops rsyslog. Then start it in the postrotate. Although that seems too invasive, I'm worried about prerotate script actions always running, or if they'd only run if the rotate was going to occur. A different solution would be instead of a restart, in the postrotate, (1) stop rsyslog, (2) remove the log file, (3) start rsyslog.
 
1 members found this post helpful.
Old 05-24-2013, 11:52 AM   #5
gr0undzer0
Member
 
Registered: Apr 2012
Location: Alexandria, VA
Distribution: Fedora
Posts: 46

Original Poster
Rep: Reputation: 1
Better idea of whats happening.

message is rotated to
message.1

Rsyslog continues to write to message.1 even though the log rotated. This is usually solved by restarting rsyslog in postrotate.

Every night this happens

but if I go in and restart rsyslog manually lo and behold its writting to message now not message.1
 
Old 05-28-2016, 02:29 AM   #6
bl4sphemy
LQ Newbie
 
Registered: May 2016
Location: Texas, USA
Posts: 1

Rep: Reputation: Disabled
Just answering this for posterity.

The problem with this logrotate stanza appears to have been the "service rsyslog restart". I have posted an example below that works.


/etc/logrotate.d/syslog
/var/log/messages /var/log/secure /var/log/maillog /var/log/spooler /var/log/boot.log /var/log/cron {
daily
rotate 7
sharedscripts
postrotate
/bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
endscript
}
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Question about logrotate and weekly rotation circus78 Linux - Server 2 07-04-2012 11:17 AM
How to achieve syslog rotation in red hat linux? shekhar_puttur Red Hat 1 01-25-2011 09:12 AM
apache request_log rotation - logrotate noir911 Linux - Server 2 09-10-2008 11:29 PM
application crashes at syslog logrotate siege618 Linux - Server 4 06-17-2007 05:47 AM
Log Rotation using Logrotate keysorsoze Linux - General 4 04-13-2007 03:51 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Software

All times are GMT -5. The time now is 05:01 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration