2

My syslog file is getting a bit unmanageable. I believed I had configured this previously to rotate daily but obviously something has gone amiss.

At the moment, my /var/log looks like this:

-rw-r----- 1 syslog adm             0 Feb 25 06:25 syslog
-rw-r----- 1 syslog adm     696223089 Jul 15 12:06 syslog.1.1
-rw-r----- 1 syslog adm        518918 Feb 24 06:25 syslog.2.gz
-rw-r----- 1 syslog adm        273006 Feb 23 06:25 syslog.3.gz
-rw-r----- 1 syslog adm        309765 Feb 22 06:25 syslog.4.gz
-rw-r----- 1 syslog adm        545437 Feb 21 06:25 syslog.5.gz
-rw-r----- 1 syslog adm        545733 Feb 20 06:25 syslog.6.gz
-rw-r----- 1 syslog adm        646461 Feb 19 06:25 syslog.7.gz

Syslog continues to log to syslog.1.1 but not to syslog.

/etc/logrotate.d/rsyslog looks like:

/var/log/syslog
{
    rotate 7
    daily
    missingok
    notifempty
    delaycompress
    compress
    postrotate
            reload rsyslog >/dev/null 2>&1 || true
    endscript
}

And my syslog entry in /etc/rsyslog.d/50-default.conf looks like:

*.*;auth,authpriv.none          -/var/log/syslog

Running

sudo logrotate --force rsyslog

Doesn't seem to move this along.

Zakalwe
  • 143
  • 2
  • 7

1 Answers1

2

Put this line:

invoke-rc.d rsyslog rotate > /dev/null

instead of:

reload rsyslog >/dev/null 2>&1 || true

It will cause rsyslog to properly reload, close rotated files and new open log files for writing.

Tomasz Klim
  • 458
  • 5
  • 10
  • 1
    I amended this and ran **sudo logrotate --force rsyslog** But no joy. I ran **reload rsyslog >/dev/null 2>&1 || true** And was told that... **The script you are attempting to invoke has been converted to an Upstart job, but rotate is not supported for Upstart jobs. invoke-rc.d: initscript rsyslog, action "rotate" failed** – Zakalwe Jul 15 '15 at 14:25
  • Ok, so execute "service rsyslog reload" instead. – Tomasz Klim Jul 15 '15 at 15:38
  • Sorry. Should have said that I did try that. `service rsyslog reload` states `reload: Not running`. `service rsyslog status` states `rsyslog start/running`. – Zakalwe Jul 16 '15 at 08:40
  • Try "service rsyslog restart", maybe reload doesn't work on Upstart... – Tomasz Klim Jul 16 '15 at 08:47
  • Think I've found a reason for this at https://bugs.launchpad.net/ubuntu/+source/rsyslog/+bug/1331891. Seems "reload" is not supported by upstart jobs. An updated fix was provided for 14.04 but we're using 12.04 LTS so not sure how that can be installed on this. I thought that if we were using an LTS, these types of things would be fixed? – Zakalwe Jul 16 '15 at 10:16