logrotate deletes all maillogs older than one day

Question

I see only two files maillog and maillog.1 in /var/log.

grepping for maillog in logrotate.d directory gives three files that have a mention of maillog.

syslog

/var/log/messages /var/log/secure /var/log/maillog /var/log/spooler /var/log/boot.log /var/log/cron {
#/var/log/messages /var/log/secure /var/log/spooler /var/log/boot.log /var/log/cron {
        daily
    sharedscripts
    postrotate
        /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
        /bin/kill -HUP `cat /var/run/rsyslogd.pid 2> /dev/null` 2> /dev/null || true
    endscript
}

syslog-ng

/var/log/messages /var/log/secure /var/log/maillog /var/log/spooler /var/log/boot.log /var/log/cron /var/log/kern.log /var/log/kern {
    sharedscripts
    postrotate
        /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
        /bin/kill -HUP `cat /var/run/rsyslogd.pid 2> /dev/null` 2> /dev/null || true
    endscript
}

and maillog.

/var/log/maillog  {
    daily
    compress
#    rotate 365
    rotate 14 
    sharedscripts
    postrotate
        /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
        /bin/kill -HUP `cat /var/run/rsyslogd.pid 2> /dev/null` 2> /dev/null || true
    endscript
}

I am new to logrotate so may be I am missing something obvious. What can be the issue? The setup was already done when I started managing the server so I don't also know as do why do I have 3 mentions for maillog in logrotate.

Answer 1

• The first one is created by default.
• The second one is created when installing syslog-ng.
• The previous sysadmin creates the third one manually (maybe).

Which syslog service are you running?

ps -ef | grep syslog

---

UPDATE

Since you're using syslog-ng, all of the postrotate scripts are wrong, change it to something like this:

postrotate
    /bin/kill -HUP `cat /opt/syslog-ng/var/run/syslog-ng.pid 2> /dev/null` 2> /dev/null || true
endscript

then run in debug mode (no changes will be made to the logs) to see what happens:

logrotate -d -f /etc/logrotate.d/syslog-ng