Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm running CentOS6 and I configured rsyslog to monitor my iptables warning messages and dump them in /var/log/iptables.log. I went through my logrotate.d/syslog file and added iptables.log so logrotate would pick up and rotate the logs. The file looks like this:

        /bin/kill -HUP `cat /var/run/ 2> /dev/null` 2> /dev/null || true

However, when I run logrotate -f -v logrotate.conf to trigger a force roll, the iptables.log file doesn't roll. To make logrotate not barf on the iptables file, I created a iptables.log-20121014 file.

My output when I run the command looks like this:

rotating log /var/log/iptables.log, log->rotateCount is 4
dateext suffix '-20121021'

I'm flummoxed. How do I get logrotate to roll the file? I'm not 100% sure if I configured it correctly, but I don't know enough to be certain if that's the case.

share|improve this question
up vote 3 down vote accepted

I believe a more effective solution would be to actually create a specific logrotate instance for iptables instead of adding it directly to your syslog logrotate instance.

Do this by:

$ touch /etc/logrotate.d/iptables

Now, configure the logrotation as you'd like, an example would be the following (You may find all options HERE (logrotate.conf):

$ vi iptables
/var/log/iptables.log {
size 30k
create 0600 root root
    /etc/rc.d/init.d/rsyslog restart ; sleep 5

This should provide the functionality you're searching for.

share|improve this answer
Thanks! That did exactly what I needed it to. Appreciate the helpful explanation! – FloppyDisk Oct 24 '12 at 15:37
You're quite welcome! – RWC Oct 24 '12 at 20:35
Restarting rsyslog after creating a new logrotate directive is unnecessary since logrotate is separate from rsyslog and called via cron. Also, invoke-rc.d appears not to work on CentOS 6. – reflexiv Jul 19 '14 at 0:17

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.