0

So right now I have a bunch of production servers, and I setup remote logging through rsyslog to our staging servers. For anything actually logged through rsyslog it works fine (Even when rotated) but our php5_errors log is not handled through rsyslog for a few various reasons, including we have instances of php writing to it ourselves (that was another devs decision that I can't easily change)

Anyway, it seemed the simple option was to import the log files I wanted (Also doing this with modsecurity's logfile)

Anyway, whenever the log files rotate, it stops sending new information to the remote server. So far I have not been able to figure out how to fix it without restarting rsyslog.

Any help on this matter would be appreciated

all servers are debian squeeze servers, running rsyslog, and php 5.3

Improve this question

1 Answer 1

Reset to default
0

The problem here is that your rotate will move the current file (e.g. mylog), to a new name (e.g. mylog.0), and open a new one with the same name.

However, rsyslog only opens the file the first time it starts. After that, it keeps reading from the same file - even if you rename the file while it's working.

The solution here is to fix your rotating script. Instead of moving the file and creating a new one with the same name, it should copy the contents of the file and then zero it. That way rsyslog can keep reading from the same filehandle. Exactly how to do this depends on what you use to rotate the logs - if it's the common logrotate, you simply add the option 

copytruncate

to the log entry.

Improve this answer
1
  • I have done that. My current config in logrotate is this for the affected files: # Rotate modsecuritys logs /usr/local/modsecurity/logs/*.log { rotate 4 weekly missingok compress delaycompress notifempty copytruncate }
    – Excolo
    Apr 5, 2013 at 15:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .