ModSecurity not writing to new rotated log files?

Question

I've the following logs rotation set up in the OS for nginx's and modsec's logs, and it works for nginx's logs but not for modsec's. The result for modsec is that, it made a copy for the log file but it keeps on writing to the old one as followed:

-rw-r--r-- 1 root root 26996998524 Apr 30 12:00 modsec_debug.log.1
drwxr-xr-x 3 root root        4096 Apr 29 10:31 .
-rw-r--r-- 1 root root           0 Apr 29 10:31 modsec_debug.log

Can someone please tell me what I've missed? Other than 'kill -USR1 cat /var/run/nginx.pid', should I run something else? Please note that the nginx is running inside a container and I have this volume mapping: /var/log/nginx:/usr/local/openresty/nginx/logs

Other info: openresty: 1.13.6.2 Modsec: 3.0.3 Os version: Ubuntu 18.04.3 LTS

/var/log/nginx/*.log {
        daily
        missingok
        rotate 14
        compress
        delaycompress
        notifempty
        create 0640 root root
        maxsize 500M
        minsize 500M
        sharedscripts
        prerotate
                if [ -d /etc/logrotate.d/httpd-prerotate ]; then \
                        run-parts /etc/logrotate.d/httpd-prerotate; \
                fi \
        endscript
        postrotate
                docker exec www-proxy /bin/sh -c 'kill -USR1 `cat /var/run/nginx.pid`'
        endscript
}

/var/log/nginx/modsec/*.log {
        daily
        missingok
        rotate 14
        compress
        delaycompress
        notifempty
        create 0640 root root
        maxsize 500M
        minsize 500M
        sharedscripts
        prerotate
                if [ -d /etc/logrotate.d/httpd-prerotate ]; then \
                        run-parts /etc/logrotate.d/httpd-prerotate; \
                fi \
        endscript
        postrotate
                docker exec www-proxy /bin/sh -c 'kill -USR1 `cat /var/run/nginx.pid`'
        endscript
}

Thanks.

Have you seen these issue/PR's? https://github.com/SpiderLabs/ModSecurity-nginx/issues/121 https://github.com/SpiderLabs/ModSecurity-nginx/pull/198 — airween, Jun 19 '20 at 12:57

score 1 · Accepted Answer · answered Aug 12 '21 at 13:42

1

As stated Here

you have to reload configs. For that you can use a restart/reload for web server or you can use

copytruncate

option in logrotate instead of create

answered Aug 12 '21 at 13:42

Abadis

156
3

ModSecurity not writing to new rotated log files?

1 Answers1