2

My syslog file is getting a bit unmanageable. I believed I had configured this previously to rotate daily but obviously something has gone amiss.

At the moment, my /var/log looks like this:

-rw-r----- 1 syslog adm             0 Feb 25 06:25 syslog
-rw-r----- 1 syslog adm     696223089 Jul 15 12:06 syslog.1.1
-rw-r----- 1 syslog adm        518918 Feb 24 06:25 syslog.2.gz
-rw-r----- 1 syslog adm        273006 Feb 23 06:25 syslog.3.gz
-rw-r----- 1 syslog adm        309765 Feb 22 06:25 syslog.4.gz
-rw-r----- 1 syslog adm        545437 Feb 21 06:25 syslog.5.gz
-rw-r----- 1 syslog adm        545733 Feb 20 06:25 syslog.6.gz
-rw-r----- 1 syslog adm        646461 Feb 19 06:25 syslog.7.gz

Syslog continues to log to syslog.1.1 but not to syslog.

/etc/logrotate.d/rsyslog looks like:

/var/log/syslog
{
    rotate 7
    daily
    missingok
    notifempty
    delaycompress
    compress
    postrotate
            reload rsyslog >/dev/null 2>&1 || true
    endscript
}

And my syslog entry in /etc/rsyslog.d/50-default.conf looks like:

*.*;auth,authpriv.none          -/var/log/syslog

Running

sudo logrotate --force rsyslog

Doesn't seem to move this along.

  • Did you make sure that reload rsyslog >/dev/null 2>&1 || true does work? – Fox Jul 15 '15 at 12:04
  • I ran this from the command line but no effect on the logs – Zakalwe Jul 15 '15 at 14:25
2

Put this line:

invoke-rc.d rsyslog rotate > /dev/null

instead of:

reload rsyslog >/dev/null 2>&1 || true

It will cause rsyslog to properly reload, close rotated files and new open log files for writing.

  • 1
    I amended this and ran sudo logrotate --force rsyslog But no joy. I ran reload rsyslog >/dev/null 2>&1 || true And was told that... The script you are attempting to invoke has been converted to an Upstart job, but rotate is not supported for Upstart jobs. invoke-rc.d: initscript rsyslog, action "rotate" failed – Zakalwe Jul 15 '15 at 14:25
  • Ok, so execute "service rsyslog reload" instead. – Tomasz Klim Jul 15 '15 at 15:38
  • Sorry. Should have said that I did try that. service rsyslog reload states reload: Not running. service rsyslog status states rsyslog start/running. – Zakalwe Jul 16 '15 at 8:40
  • Try "service rsyslog restart", maybe reload doesn't work on Upstart... – Tomasz Klim Jul 16 '15 at 8:47
  • Think I've found a reason for this at bugs.launchpad.net/ubuntu/+source/rsyslog/+bug/1331891. Seems "reload" is not supported by upstart jobs. An updated fix was provided for 14.04 but we're using 12.04 LTS so not sure how that can be installed on this. I thought that if we were using an LTS, these types of things would be fixed? – Zakalwe Jul 16 '15 at 10:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.