signals (like HUP) are sent and processed asynchronously, so it can take a
little bit of time to be handled. Your understanding is correct.
what I normally do is not use logrotate, but do the rotation myself in a script
run from cron that does the mv of the files, sends the hub, then sleeps for a
second before starting the compression (and then normally I mv the compressed
file to a date based directory hierarchy, when you have very high log volumes,
you may want to rotate files frequently, I've done it as frequently as every
minute, and that results is LOTS of files, more than you want in one directory)
I don't know if this can be done in the postrotate stanza of logrotate.
David Lang
On Fri, 27 Aug 2021, Jean-Baptiste Denis via rsyslog wrote:
Date: Fri, 27 Aug 2021 16:34:51 +0200
From: Jean-Baptiste Denis via rsyslog <[email protected]>
Reply-To: [email protected], rsyslog-users <[email protected]>
To: [email protected]
Cc: Jean-Baptiste Denis <[email protected]>
Subject: [rsyslog] rsyslogd HUP and logrotate
Hello,
I've got a general question about logrotate postrotate script and rsyslog HUP
signal handling interaction.
Lets say I have this logrotate section:
/var/log/messages
{
rotate 4
daily
dateext
missingok
notifempty
compress
postrotate
/usr/bin/systemctl kill -s HUP rsyslog.service >/dev/null
2>&1 || true
endscript
}
And logrotate fires up. Something like might happen:
1. /var/log/messages is rotated to /var/log/messages-20210827
2. rsyslog is still writing to /var/log/messages-20210827
3. postrotate script runs, the kill signal command returns immediately
4. logrotate start compressing /var/log/messages-20210827
The "real" handling of SIGUP happens in rsyslogd mainloop and could happen
anywhere after 3, which means also after 4.
When the /var/log/messages activity is high (about 100 messages/sec), I often
have logrotate compression step complaining about "file size changed while
zipping".
I can workaround this using the delaycompress option, but I'd like to
understand if my understanding is correct and if there is a better/cleaner
solution ?
If I'm correct until this point, I can only see two options:
- using delaycompress in logrotate block
- having a command line tool that tells rsyslogd to close and reopen the log
files AND that does not exit before
its done and use this command in postrotate
What are your thoughts ? Any suggestions ?
Thank you.
Jean-Baptiste
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T
LIKE THAT.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
