I have the following logrotate configuration and its acting really strange. Logrotate does rotate the files but exits with an error every night and rsyslog continues to write to the old file for SOME of the logs. Its strange that maill log does get written to the new file but all the others don't. Unless I miss typed something this config should match exactly another rhel6 server I have. I can restart rsyslog manually though. With the exact same command and it works fine. I don't get it.

etc/logrotate.conf

weekly
rotate 4
create
include /etc/logrotate.d
/var/log/wtmp /var/log/btmp {
daily
rotate 7
create 0664 root utmp
}

/etc/logrotate.d/syslog
/var/log/messages /var/log/secure /var/log/maillog /var/log/spooler /var/log/boot.log /var/log/cron {
daily
rotate 7
sharedscripts
postrotate
service rsyslog restart
endscript
}

You can add criteria for file size and if you don't then it will choose a default that is probably stated in the manpage for logrotate. It will not always rotate a file if the file size doesn't match the criteria. However if you include force in the criteria, it will always rotate no matter the size of the file.

For size you would put in or K depending on the maximum size log files you wish to allow.

The force option is when you invoke logrotate, not in the config by the way.

I'm not sure if it is cut/paste, or literal if there are no spaces to indent your postrotate options. I'm also not sure if that would be mandated. The examples in the man page indent the postrotate script lines 3 or 4 spaces. You may want to try that.

What error is it reporting? Or do you mean error is your interpretation when you're saying that it doesn't always rotate files?

1 members found this post helpful.

The file is created but rsyslog keeps writing to the old one.

A backup is created, but the original is left alone, and when you restart rsyslog it merely continues that last file? If that's correct, then in your postrotate steps, remove the log file for rsyslog.

Logrotate shouldn't do that. Perhaps this is rsyslog doing this. I'm betting it is. How about a prerotate script which stops rsyslog. Then start it in the postrotate. Although that seems too invasive, I'm worried about prerotate script actions always running, or if they'd only run if the rotate was going to occur. A different solution would be instead of a restart, in the postrotate, (1) stop rsyslog, (2) remove the log file, (3) start rsyslog.

1 members found this post helpful.

Better idea of whats happening.

message is rotated to
message.1

Rsyslog continues to write to message.1 even though the log rotated. This is usually solved by restarting rsyslog in postrotate.

Every night this happens

but if I go in and restart rsyslog manually lo and behold its writting to message now not message.1

Just answering this for posterity.

The problem with this logrotate stanza appears to have been the "service rsyslog restart". I have posted an example below that works.


/etc/logrotate.d/syslog
/var/log/messages /var/log/secure /var/log/maillog /var/log/spooler /var/log/boot.log /var/log/cron {
daily
rotate 7
sharedscripts
postrotate
/bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
endscript
}