6

Our log file /var/log/syslog does not seem to be rotating, even though the logrotate config /etc/logrotate.d/rsyslog exists:

/var/log/syslog
{
    rotate 7
    daily
    missingok
    notifempty
    delaycompress
    compress
    postrotate
        reload rsyslog >/dev/null 2>&1 || true
    endscript
}

/var/log/mail.info
/var/log/mail.warn
/var/log/mail.err
/var/log/mail.log
/var/log/daemon.log
/var/log/kern.log
/var/log/auth.log
/var/log/user.log
/var/log/lpr.log
/var/log/cron.log
/var/log/debug
/var/log/messages
{
    rotate 4
    weekly
    missingok
    notifempty
    compress
    delaycompress
    sharedscripts
    postrotate
        reload rsyslog >/dev/null 2>&1 || true
    endscript
}

See, the syslog log file is 600M with no old files or compressed.

-rw-r-----  1 syslog   adm    600M Nov  9 20:30 syslog
  • The rotation is based on logfile age, not size. Is it a day old yet? – muru Nov 9 '15 at 20:42
  • Yes, server has been running for over 30 days. Actually, it appears that logrotate is not working at all, because there are no compressed or backup log files in /var/log. Anywhere to log for issues? – Justin Nov 9 '15 at 20:50
  • What happens if you run logrotate yourself? sudo logrotate -d /etc/logrotate.conf - the -d enables debug mode. – muru Nov 9 '15 at 20:52
  • Running as ubuntu I see error: skipping "/var/log/syslog" because parent directory has insecure permissions (It's world writable or writable by group which is not "root") Set "su" directive in config file to tell logrotate which user/group should be used for rotation.. The permissions on /var/log are 775. – Justin Nov 9 '15 at 20:56
13

I found the problem, somehow su directive got removed from /etc/logrotate.conf, so needed to add:

# use the syslog group by default, since this is the owning group
# of /var/log/syslog.
su root syslog
1

I had a similar problem and it seems to have been caused by some kind of incompatibility between the logrotate configuration and the new systemd replacement for sysv/init.d

I had to edit the /etc/logrotate.d/rsyslog and replace

invoke-rc.d rsyslog rotate > /dev/null

with

systemctl kill -s HUP --kill-who=main rsyslog.service

the previous line looked like it was working, and said so, but did not manage to get rsyslog to reopen its logfiles.

0

Based on Samuel's comment, modified /usr/lib/rsyslog/rsyslog-rotate

#!/bin/sh

if [ -d /run/systemd/system ]; then
    systemctl kill -s HUP --kill-who=main rsyslog.service
else
    invoke-rc.d rsyslog rotate > /dev/null
fi
  • What system are you running? I did not find that file on my Ubuntu 16.04 LTS – Samuel Åslund Dec 29 '19 at 15:58
  • Ubuntu 18.04.3 LTS, kernel 4.15.18-21-pve x86_64 – Matteljay Dec 30 '19 at 16:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.