Control: found -1 rsyslog/8.27.0-3 Control: severity -1 important
Hello,
I seem to have just experienced this long-standing bug.
Today my logs were rotated, but new entries are still added to the old .1 files:
$ ls -altrF /var/log/ | tail -n 25
-rw-r--r-- 1 root root 272442 Jun 25 11:08 dpkg.log.1
-rw-r----- 1 root adm 0 Jun 25 11:11 syslog
-rw-r----- 1 root adm 0 Jun 25 11:11 user.log
-rw-r----- 1 root adm 0 Jun 25 11:11 messages
-rw-r----- 1 root adm 0 Jun 25 11:11 kern.log
-rw-r----- 1 root adm 0 Jun 25 11:11 debug
-rw-r----- 1 root adm 0 Jun 25 11:11 daemon.log
-rw-r----- 1 root adm 0 Jun 25 11:11 auth.log
-rw-rw-r-- 1 root utmp 292292 Jun 25 11:11 lastlog
-rw-r----- 1 root adm 139401 Jun 25 11:37 debug.1
-rw-r----- 1 root adm 652352 Jun 25 11:38 kern.log.1
-rw-r----- 1 root adm 8257 Jun 25 11:48 user.log.1
-rw-r----- 1 root adm 524000 Jun 25 11:48 messages.1
-rw-r----- 1 root adm 130569 Jun 25 11:54 syslog.1
-rw-r----- 1 root adm 273219 Jun 25 11:54 daemon.log.1
-rw-rw-r-- 1 root utmp 500352 Jun 25 12:00 wtmp.1
-rw-r--r-- 1 root root 0 Jun 25 12:01 aptitude
drwxr-xr-x 2 root root 4096 Jun 25 12:01 apt/
-rw-r--r-- 1 root root 0 Jun 25 12:01 dpkg.log
-rw-r--r-- 1 root root 0 Jun 25 12:01 alternatives.log
drwxr-s--- 2 Debian-exim adm 4096 Jun 25 12:01 exim4/
-rw-rw---- 1 root utmp 0 Jun 25 12:01 btmp
drwxr-xr-x 7 root root 4096 Jun 25 12:01 ./
-rw-r----- 1 root adm 56728 Jun 25 12:01 auth.log.1
-rw-rw-r-- 1 root utmp 768 Jun 25 12:06 wtmp
The problem seems to be that the postrotate script run by logrotate is:
$ tail -n 4 /etc/logrotate.d/rsyslog
postrotate
invoke-rc.d rsyslog rotate > /dev/null
endscript
}
but manually invoking that command fails:
# invoke-rc.d rsyslog rotate
[FAIL] Closing open files: rsyslogd failed!
Nonetheless, systemd tells me that rsyslog is running and everything is
fine:
# service rsyslog status
● rsyslog.service - System Logging Service
Loaded: loaded (/lib/systemd/system/rsyslog.service; enabled; vendor
preset:
Active: active (running) since Sun 2017-06-25 11:06:19 CEST; 1h 32min ago
Docs: man:rsyslogd(8)
http://www.rsyslog.com/doc/
Main PID: 631 (rsyslogd)
Tasks: 4 (limit: 4915)
CGroup: /system.slice/rsyslog.service
└─631 /usr/sbin/rsyslogd -n
Jun 25 11:06:19 HOST systemd[1]: Starting System Logging Service...
Jun 25 11:06:19 HOST rsyslogd[631]: [origin software="rsyslogd" swVersion="8.
Jun 25 11:06:19 HOST systemd[1]: Started System Logging Service.
If I manually restart rsyslog, it obviously starts writing to the new
log files, as it should:
# service rsyslog restart
and everything is back to normal.
Please fix this bug once and for all.
In case you need any further debugging information, please do not
hesitate to ask me.
Thanks for your time!
--
http://www.inventati.org/frx/
There's not a second to spare! To the laboratory!
..................................................... Francesco Poli .
GnuPG key fpr == CA01 1147 9CD2 EFDF FB82 3925 3E1C 27E1 1F69 BFFE
pgp4gimItyH2n.pgp
Description: PGP signature
