logrotate fails to rotate syslog occassionally

2.5k Views Asked by At

Can someone please tell me why occasionally syslog does not rotate and keeps logging in the same file?

After the following customization to the default setting the occasional syslog file rotation issue is observed:

  1. Path for syslog is changed from default /var/log/syslog to /opt/vortex/log/syslog (changed in /etc/rsyslog.conf as given below)

    $template ATMFormat,"%$YEAR% %timegenerated%::%syslogtag%:%msg:::$%\n" auth,authpriv.* /var/log/auth.log .;auth,authpriv.none -/opt/vortex/log/syslog;ATMFormat

  2. syslog rotation rule is changed from default weekly to daily and set to retain last 30 files (changed in /etc/logrotate.d/rsyslog)

Please find the given below details of configurations and scripts for your reference.

logrotate is scheduled daily through cron by placing logrotate script file in /etc/cron.daily directory. crontab has the following definition

# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.

SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

# m h dom mon dow user  command
17 *    * * *   root    cd / && run-parts --report /etc/cron.hourly
0 0 * * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6    * * 7   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6    1 * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
#

/etc/cron.daily/logrotate script has the below rules

#!/bin/sh

test -x /usr/sbin/logrotate || exit 0
/usr/sbin/logrotate /etc/logrotate.conf

The contents of logrotate.conf is given below:

# see "man logrotate" for details
# rotate log files weekly
weekly

# keep 4 weeks worth of backlogs
rotate 4

# create new (empty) log files after rotating old ones
create

# uncomment this if you want your log files compressed
#compress

# packages drop log rotation information into this directory
include /etc/logrotate.d

# no packages own wtmp, or btmp -- we'll rotate them here
/var/log/wtmp {
    missingok
    monthly
    create 0664 root utmp
    rotate 1
}

/var/log/btmp {
    missingok
    monthly
    create 0660 root utmp
    rotate 1
}

# system-specific logs may be configured here

log rotate configuration for system log is specified in /etc/logrotate.d/rsyslog as given below :

/opt/vortex/log/syslog
{
    rotate 30
    daily
    missingok
    notifempty
    delaycompress
    compress
    postrotate
        invoke-rc.d rsyslog reload > /dev/null
    endscript
}

/var/log/mail.info
/var/log/mail.warn
/var/log/mail.err
/var/log/mail.log
/var/log/daemon.log
/var/log/kern.log
/var/log/auth.log
/var/log/user.log
/var/log/lpr.log
/var/log/cron.log
/var/log/debug
/var/log/messages
{
    rotate 4
    weekly
    missingok
    notifempty
    compress
    delaycompress
    sharedscripts
    postrotate
        invoke-rc.d rsyslog reload > /dev/null
    endscript
}

Thanks for your help

0

There are 0 best solutions below