2

I have an extremely busy log file (let's call it /var/log/service.log) that is also frequently searched for troubleshooting reasons. Output to it is nearly continuous and 24/7. It probably puts out around 1-2 GB/day, but we need all of it.

Because fgrep of a large log file is impractically slow, there is a need to rotate frequently. I have logrotate set to run in /etc/cron.hourly, with an hourly directive and a size limit of 512M or so.

This works as expected: the file is rotated from /var/log/service.log to /var/log/service.log-20150810 or what have you. The problem is, the renaming is just a cosmetic change on the inode/directory entry, so rsyslogd continues writing to /var/log/service.log-20150810 now and for some time, while the newly created /var/log/service.log sits empty. At some point, rsyslogd does decide to start writing to the new one instead, but I am not clear on its rhyme or reason for doing so.

Anyway, what I need is some way to "kick" rsyslogd to tell it to start writing to a new, pristine /var/log/service.log following the log rotation. Sending it SIGHUP doesn't seem to do the trick. Any ideas that don't involve potentially losing lots of log entries (i.e. restarting rsyslogd) would be appreciated!

(Side note: I gather that the logrotate naming scheme would lead to /var/log/service.log.1 and whatnot, so, I'm a bit puzzled to see /var/log/service.log-20150810 alongside it. Does rsyslogd do its own rotation internally, too? Are there some adverse implications to this?)

Many thanks in advance!

5
  • Can you post your logrotate configuration file? Aug 11, 2015 at 17:43
  • 1
    Sending SIGHUP is the right way, according to the man page. Consider filing a bug report. Aug 11, 2015 at 18:18
  • So, I added 'killall -HUP rsyslogd' as a postrotate stanza to the logrotate configuration, and the crond log confirms that it runs, but it seems to have no effect; rsyslogd continues to write to the old log file. What else can be done here? Aug 25, 2015 at 17:09
  • I have the exact same situation and cannot find a solution currently. Jun 25, 2022 at 9:47
  • All I've been able to devise is to restart the rsyslogd service as part of the postrotate script. Jun 26, 2022 at 15:50

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy