Hi, I am facing a weird logrotate issue in my central syslog system (receiving 
logs from various host via imtcp). Logrotate does not compress syslog templated 
log files. It does compress and rotates other log files generated by rsyslog, 
but not the ones generated using a template.

Syslog config:


 template(name="apache_log" type="string"
     string="/data/logs/apache.log")

    if $syslogtag startswith '(httpd' then {
      action(type="omfile" DynaFile="apache_log" 
Template="RSYSLOG_SyslogProtocol23Format"
        DirCreateMode="0750" dirOwner="root" dirGroup="logs"
        FileCreateMode="0640" fileOwner="root" fileGroup="logs")
    stop
}

local2.*  action(name="local2_messageslog" type="omfile"  
File="/data/logs/messages")



Logrotate config:
 #  cat /etc/logrotate.conf |grep -v "^#"

daily
rotate 3
create
dateext
maxage 7
compress
include /etc/logrotate.d


$cat /etc/logrotate.d/syslog

/data/logs/messages
/data/logs/apache.log
{
    sharedscripts
    missingok
    daily
    rotate 4
    postrotate
        /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || 
true
    endscript
}

Logrotate will compress and rotate "messages" file, but not the "apache.log" 
file. It will append the date at the end of the file but will not compress. 
This result in files not rotated and keeping logs longer than 4 days.


-rw-r----- 1 root logs  2910357960 Nov  9 03:53 messages
-rw-r----- 1 root logs  1725989639 Nov  6 00:01 messages-20231106.gz
-rw-r----- 1 root logs  1852598019 Nov  7 00:01 messages-20231107.gz
-rw-r----- 1 root logs  2209372695 Nov  8 00:01 messages-20231108.gz
-rw-r----- 1 root logs  2036382265 Nov  9 00:01 messages-20231109.gz

-rw-r----- 1 root logs    82458243 Nov  9 03:53 apache.log
-rw-r----- 1 root logs   501509524 Nov  1 00:01 apache.log-20231101
-rw-r----- 1 root logs   596170609 Nov  2 00:00 apache.log-20231102
-rw-r----- 1 root logs   528313043 Nov  3 00:00 apache.log-20231103
-rw-r----- 1 root logs   475893564 Nov  4 00:00 apache.log-20231104
-rw-r----- 1 root logs    26731791 Nov  5 00:00 apache.log-20231105.gz
-rw-r----- 1 root logs    26634166 Nov  6 00:01 apache.log-20231106.gz
-rw-r----- 1 root logs   518016884 Nov  7 00:01 apache.log-20231107
-rw-r----- 1 root logs   507646042 Nov  8 00:01 apache.log-20231108
-rw-r----- 1 root logs   501009363 Nov  9 00:00 apache.log-20231109

I manually added gz extension on some files and indeed they were 
deleted/rotated, so I believe the problem is that logs are not compressed.

Any ideas why is this happening only on log files generated with syslog 
templates?

p.s For simplicity, I just added one syslog template log (apache) however, 
there are 8 more templated files which have the exact same issue (date 
extension but not compressed).

Thanks
D.
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of 
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE 
THAT.

Reply via email to