Rsyslog doesn't write logs to file after logrotate

General discussions here

Moderator: rgerhards

Google Ads


Rsyslog doesn't write logs to file after logrotate

Postby pippo » Tue Jun 27, 2017 12:23 pm

Hi,

I'm facing a strange issue with rsyslog.

I configured logrotation for my logfile, this is running fine.

But when the logs are rotated, rsyslog keeps writing to the same file (that is normal, because I didn't reloaded rsyslog for the moment).

I tried to :

Code: Select all
systemctl restart rsyslog


AND

Code: Select all
kill -HUP $(cat /var/run/rsyslogd.pid)
kill $(cat /var/run/rsyslog.pid)
systemctl start rsyslog


AND Changing the logfile name in rsyslog.conf

When I look which file is used by rsyslog, it shows no file :
Code: Select all
[root@elk-31-t ~]# ps -aux |grep rsyslog
root      6810  0.0  0.0 403112  4056 ?        Ssl  11:57   0:00 /sbin/rsyslogd -n
root      6877  0.0  0.0 112668   964 pts/0    S+   12:04   0:00 grep --color=auto rsyslog
[root@elk-31-t ~]# ls -l /proc/6810/fd
total 0
lr-x------ 1 root root 64 27 juin  11:57 0 -> /dev/null
l-wx------ 1 root root 64 27 juin  11:57 1 -> /dev/null
lrwx------ 1 root root 64 27 juin  11:57 10 -> anon_inode:[eventpoll]
l-wx------ 1 root root 64 27 juin  11:57 2 -> /dev/null
lrwx------ 1 root root 64 27 juin  11:57 3 -> socket:[29329608]
lrwx------ 1 root root 64 27 juin  11:57 4 -> socket:[29329613]
lrwx------ 1 root root 64 27 juin  11:57 5 -> socket:[29329614]
lrwx------ 1 root root 64 27 juin  11:57 6 -> socket:[29329617]
lrwx------ 1 root root 64 27 juin  11:57 7 -> socket:[29329618]
lrwx------ 1 root root 64 27 juin  11:57 8 -> socket:[29329623]
lrwx------ 1 root root 64 27 juin  11:57 9 -> anon_inode:[eventpoll]


Here is my logrotate config (for syslog) :

Code: Select all
/var/log/cron
/var/log/maillog
/var/log/rsyslog-log
/var/log/secure
/var/log/spooler
{
    daily
    rotate 2
    dateext
    notifempty
    create
    sharedscripts
    postrotate
      kill -HUP $(cat /var/run/rsyslogd.pid)
    endscript

}


How to restart rsyslog properly and avoid this issue?

Thanks
pippo
New
 
Posts: 6
Joined: Fri Jun 16, 2017 11:05 am

Urgent Question?

  • Pulling out your Hair?
  • Wasting Time and Money?
  • Deadline Approaching?

Re: Rsyslog doesn't write logs to file after logrotate

Postby pippo » Tue Jun 27, 2017 12:36 pm

After 1 hour, I checked again :
Code: Select all
[root@elk-31-t ~]# ls -l /proc/6954/fd
total 0
lr-x------ 1 root root 64 27 juin  12:12 0 -> /dev/null
l-wx------ 1 root root 64 27 juin  12:12 1 -> /dev/null
lrwx------ 1 root root 64 27 juin  12:12 10 -> anon_inode:[eventpoll]
l-wx------ 1 root root 64 27 juin  12:12 11 -> /var/log/rsyslog-log
l-wx------ 1 root root 64 27 juin  12:12 2 -> /dev/null
lrwx------ 1 root root 64 27 juin  12:12 3 -> socket:[29332556]
lrwx------ 1 root root 64 27 juin  12:12 4 -> socket:[29332561]
lrwx------ 1 root root 64 27 juin  12:12 5 -> socket:[29332562]
lrwx------ 1 root root 64 27 juin  12:12 6 -> socket:[29332565]
lrwx------ 1 root root 64 27 juin  12:12 7 -> socket:[29332566]
lrwx------ 1 root root 64 27 juin  12:12 8 -> socket:[29332571]
lrwx------ 1 root root 64 27 juin  12:12 9 -> anon_inode:[eventpoll]


We can see that rsyslog is now writing to the good file :
Code: Select all
l-wx------ 1 root root 64 27 juin  12:12 11 -> /var/log/rsyslog-log


Also I tested many times the log rotation with :
Code: Select all
logrotate -f -v /etc/logrotate.conf


Sometimes, rsyslog immediately switches to the new logfile, and sometimes it doesn't.

Rsyslog maybe needs some time before begining to write in the file?

Thanks
pippo
New
 
Posts: 6
Joined: Fri Jun 16, 2017 11:05 am

Re: Rsyslog doesn't write logs to file after logrotate

Postby pippo » Tue Jun 27, 2017 1:29 pm

It seems that rsyslog will open the file only when writing in it. This might explain why I couldn't immediately see any file with ls -l /proc/6954/fd


Problem solved
pippo
New
 
Posts: 6
Joined: Fri Jun 16, 2017 11:05 am

Re: Rsyslog doesn't write logs to file after logrotate

Postby dlang » Tue Jun 27, 2017 5:59 pm

Yes, rsyslog only opens/creates a file when there is a log message to go into the file.
dlang
Frequent Poster
 
Posts: 1001
Joined: Mon Sep 15, 2008 7:44 am

Google Ads



Return to General

Who is online

Users browsing this forum: No registered users and 1 guest

cron