3

My syslog file is getting a bit unmanageable. I believed I had configured this previously to rotate daily but obviously something has gone amiss.

At the moment, my /var/log looks like this:

-rw-r----- 1 syslog adm             0 Feb 25 06:25 syslog
-rw-r----- 1 syslog adm     696223089 Jul 15 12:06 syslog.1.1
-rw-r----- 1 syslog adm        518918 Feb 24 06:25 syslog.2.gz
-rw-r----- 1 syslog adm        273006 Feb 23 06:25 syslog.3.gz
-rw-r----- 1 syslog adm        309765 Feb 22 06:25 syslog.4.gz
-rw-r----- 1 syslog adm        545437 Feb 21 06:25 syslog.5.gz
-rw-r----- 1 syslog adm        545733 Feb 20 06:25 syslog.6.gz
-rw-r----- 1 syslog adm        646461 Feb 19 06:25 syslog.7.gz

Syslog continues to log to syslog.1.1 but not to syslog.

/etc/logrotate.d/rsyslog looks like:

/var/log/syslog
{
    rotate 7
    daily
    missingok
    notifempty
    delaycompress
    compress
    postrotate
            reload rsyslog >/dev/null 2>&1 || true
    endscript
}

And my syslog entry in /etc/rsyslog.d/50-default.conf looks like:

*.*;auth,authpriv.none          -/var/log/syslog

Running

sudo logrotate --force rsyslog

Doesn't seem to move this along.

Zakalwe
  • 153

1 Answers1

2

Put this line:

invoke-rc.d rsyslog rotate > /dev/null

instead of:

reload rsyslog >/dev/null 2>&1 || true

It will cause rsyslog to properly reload, close rotated files and new open log files for writing.

Tomasz Klim
  • 468