5

I have set up a Syslog-ng server with some filters to split certain traffic into different files. I modified the logrotate file located at /etc/logrotate.d/syslog-ng to rotate these files daily, but logrotate doesn't run as expected. I have to manually rotate the logs with sudo logrotate -f /etc/logrotate.d/syslog-ng

I can't find the reason why it's not running automatically.

Contents of the /etc/logrotate.d/syslog-ng file (the section i added is the very top block):

/var/log/wlc /var/log/userid /var/log/cltolt040 /var/log/ise /var/log/vg /var/log/firewall /var/log/steelhead /var/log/syslog /var/log/f5 /var/log/switch /var/log/router 
{
        su root root 
        rotate 14
        create 0755 ics ics 
        daily
        missingok
        notifempty

        compress
        postrotate
                invoke-rc.d syslog-ng reload > /dev/null
        endscript

}

/var/log/mail.info
/var/log/mail.warn
/var/log/mail.err
/var/log/mail.log
/var/log/daemon.log
/var/log/kern.log
/var/log/auth.log
/var/log/user.log
/var/log/lpr.log
/var/log/cron.log
/var/log/debug
/var/log/messages
/var/log/error
{
        rotate 4
        weekly
        missingok
        notifempty
        compress
        delaycompress
        sharedscripts
        postrotate
                invoke-rc.d syslog-ng reload > /dev/null
        endscript
}

Contents of crontab:

# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.

SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

# m h dom mon dow user  command
17 *    * * *   root    cd / && run-parts --report /etc/cron.hourly
25 6    * * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6    * * 7   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6    1 * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )

Contents of /etc/cron.daily/logrotate:

#!/bin/sh

# Clean non existent log file entries from status file
cd /var/lib/logrotate
test -e status || touch status
head -1 status > status.clean
sed 's/"//g' status | while read logfile date
do
    [ -e "$logfile" ] && echo "\"$logfile\" $date"
done >> status.clean
mv status.clean status

test -x /usr/sbin/logrotate || exit 0
/usr/sbin/logrotate /etc/logrotate.conf

I was thinking it could be a permissions issue, but if that was the case wouldn't running logrotate -f also fail?

5
  • Curious: Why are doing su root root when logrotate runs as root b y default? And why are you applying all those options to /var/log/syslog? Especially the create option!
    – muru
    Commented Nov 10, 2016 at 12:59
  • I added su root root while troubleshooting this issue, I don't know if it's actually needed. What's wrong with applying them to /var/log/syslog? Is that file special? I tried adding the create option so the "ics" user doesn't have to constantly use sudo to grep the logs.
    – John K.
    Commented Nov 10, 2016 at 13:06
  • It's the general log file. If you want to let a user read logs, add them to the adm group instead of changing modes and ownerships of the logs. Most logs are under the adm group by default precisely for this reason.
    – muru
    Commented Nov 10, 2016 at 13:09
  • Ok, thanks for the recommendation. So for my Syslog-ng config, would it be better to send the syslogs to a new file instead of Syslog file?
    – John K.
    Commented Nov 10, 2016 at 13:23
  • So in /etc/logrotate.conf it looks like it runs under the root:syslog group. Could this be an issue since the actual log files are owned by root:adm?
    – John K.
    Commented Nov 10, 2016 at 13:50

1 Answer 1

11

It looks like I got this fixed. I tried to run logrotate on the conf file instead of the syslog-ng file, logrotate -d /etc/logrotate.conf but it was throwing this error Ignoring /etc/logrotate.conf because of bad file mode. Did a quick search and found that this could be because of file permissions. I changed permissions on the file sudo chmod 644 /etc/logrotate.conf and ran a test by changing the daily time in /etc/crontab.

The files were then rotated automatically. So looks like this was the fix. Thanks for the help.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .