rsyslog not rotating at fixed file size

Question

I am trying to create a separate log file for a application in Linux. So far I have created a .conf script to separate log in custom log file based on program name and it's working correctly.

But, I want to limit the size of log file at 10K and I am using $outchannel for this purpose. The script is stored as /etc/rsyslog.d/00-abc_log.conf:

$outchannel o_abc, /var/log/abc.log, 10240, /home/xyz/logrot
if $programname == 'abc' then :omfile:$o_abc

and script /home/xyz/logrot contains the following:

mv -f /var/log/abc.log /var/log/abc.log.1

Below the 10K limit the logging is working correctly, but after log exceeds 10K size limit, file abc.log.1 doesn't generated and logging in abc.log stops.

If it matters, my system is Xubuntu 12.04 running rsyslog-5.8.6.

Thanks in advance.

Answer 1

Your problem occurs because the application still has the file descriptor open after you moved it on the filesystem. Unless you can tell the program to restart logging directly after moving (usually for deamons, there's a signal for it like SIGHUP), you will have to use another method for rotation than moving files around to which are written into at that time

I suggest to use logrotate like the following. Haven't tested it, as you haven't shared the application involved.

Create your own logrotate configuration file, e.g. abclogrotate.conf:

/var/log/abc.log {
    # don't use time based rotation, but size-based
    size 10k
    # don't move, but copy-and-truncate so the application won't have to be
    # told that the file has moved.
    copytruncate
    # maximum of one old file
    rotate 1
    # counting old files starts at 1 rather than 0
    start 1
    # don't use compression
    nocompress
}

Now call logrotate like this: logrotate /path/to/abclogrotate.conf rather than your own script.