Hi, I am facing a weird logrotate issue in my central syslog system (receiving logs from various host via imtcp). Logrotate does not compress syslog templated log files. It does compress and rotates other log files generated by rsyslog, but not the ones generated using a template.
Syslog config:
template(name="apache_log" type="string"
string="/data/logs/apache.log")
if $syslogtag startswith '(httpd' then {
action(type="omfile" DynaFile="apache_log" Template="RSYSLOG_SyslogProtocol23Format"
DirCreateMode="0750" dirOwner="root" dirGroup="logs"
FileCreateMode="0640" fileOwner="root" fileGroup="logs")
stop
}
local2.* action(name="local2_messageslog" type="omfile" File="/data/logs/messages")
Logrotate config:
# cat /etc/logrotate.conf |grep -v "^#"
daily
rotate 3
create
dateext
maxage 7
compress
include /etc/logrotate.d
$cat /etc/logrotate.d/syslog
/data/logs/messages
/data/logs/apache.log
{
sharedscripts
missingok
daily
rotate 4
postrotate
/bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
endscript
}
Logrotate will compress and rotate "messages" file, but not the "apache.log" file. It will append the date at the end of the file but will not compress. This result in files not rotated and keeping logs longer than 4 days.
-rw-r----- 1 root logs 2910357960 Nov 9 03:53 messages
-rw-r----- 1 root logs 1725989639 Nov 6 00:01 messages-20231106.gz
-rw-r----- 1 root logs 1852598019 Nov 7 00:01 messages-20231107.gz
-rw-r----- 1 root logs 2209372695 Nov 8 00:01 messages-20231108.gz
-rw-r----- 1 root logs 2036382265 Nov 9 00:01 messages-20231109.gz
-rw-r----- 1 root logs 82458243 Nov 9 03:53 apache.log
-rw-r----- 1 root logs 501509524 Nov 1 00:01 apache.log-20231101
-rw-r----- 1 root logs 596170609 Nov 2 00:00 apache.log-20231102
-rw-r----- 1 root logs 528313043 Nov 3 00:00 apache.log-20231103
-rw-r----- 1 root logs 475893564 Nov 4 00:00 apache.log-20231104
-rw-r----- 1 root logs 26731791 Nov 5 00:00 apache.log-20231105.gz
-rw-r----- 1 root logs 26634166 Nov 6 00:01 apache.log-20231106.gz
-rw-r----- 1 root logs 518016884 Nov 7 00:01 apache.log-20231107
-rw-r----- 1 root logs 507646042 Nov 8 00:01 apache.log-20231108
-rw-r----- 1 root logs 501009363 Nov 9 00:00 apache.log-20231109
I manually added gz extension on some files and indeed they were deleted/rotated, so I believe the problem is that logs are not compressed.
Any ideas why is this happening only on log files generated with syslog templates?
p.s For simplicity, I just added one syslog template log (apache) however, there are 8 more templated files which have the exact same issue (date extension but not compressed).
Thanks
D.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.
Syslog config:
template(name="apache_log" type="string"
string="/data/logs/apache.log")
if $syslogtag startswith '(httpd' then {
action(type="omfile" DynaFile="apache_log" Template="RSYSLOG_SyslogProtocol23Format"
DirCreateMode="0750" dirOwner="root" dirGroup="logs"
FileCreateMode="0640" fileOwner="root" fileGroup="logs")
stop
}
local2.* action(name="local2_messageslog" type="omfile" File="/data/logs/messages")
Logrotate config:
# cat /etc/logrotate.conf |grep -v "^#"
daily
rotate 3
create
dateext
maxage 7
compress
include /etc/logrotate.d
$cat /etc/logrotate.d/syslog
/data/logs/messages
/data/logs/apache.log
{
sharedscripts
missingok
daily
rotate 4
postrotate
/bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
endscript
}
Logrotate will compress and rotate "messages" file, but not the "apache.log" file. It will append the date at the end of the file but will not compress. This result in files not rotated and keeping logs longer than 4 days.
-rw-r----- 1 root logs 2910357960 Nov 9 03:53 messages
-rw-r----- 1 root logs 1725989639 Nov 6 00:01 messages-20231106.gz
-rw-r----- 1 root logs 1852598019 Nov 7 00:01 messages-20231107.gz
-rw-r----- 1 root logs 2209372695 Nov 8 00:01 messages-20231108.gz
-rw-r----- 1 root logs 2036382265 Nov 9 00:01 messages-20231109.gz
-rw-r----- 1 root logs 82458243 Nov 9 03:53 apache.log
-rw-r----- 1 root logs 501509524 Nov 1 00:01 apache.log-20231101
-rw-r----- 1 root logs 596170609 Nov 2 00:00 apache.log-20231102
-rw-r----- 1 root logs 528313043 Nov 3 00:00 apache.log-20231103
-rw-r----- 1 root logs 475893564 Nov 4 00:00 apache.log-20231104
-rw-r----- 1 root logs 26731791 Nov 5 00:00 apache.log-20231105.gz
-rw-r----- 1 root logs 26634166 Nov 6 00:01 apache.log-20231106.gz
-rw-r----- 1 root logs 518016884 Nov 7 00:01 apache.log-20231107
-rw-r----- 1 root logs 507646042 Nov 8 00:01 apache.log-20231108
-rw-r----- 1 root logs 501009363 Nov 9 00:00 apache.log-20231109
I manually added gz extension on some files and indeed they were deleted/rotated, so I believe the problem is that logs are not compressed.
Any ideas why is this happening only on log files generated with syslog templates?
p.s For simplicity, I just added one syslog template log (apache) however, there are 8 more templated files which have the exact same issue (date extension but not compressed).
Thanks
D.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE THAT.