I'm seeing something similar with 14.04 since upgrading from 12.04 only in this case, I'm still getting kernel messages written to the logs however nothing else is until I force a restart of rsyslog. File permissions look ok though (syslog:adm).
-- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to rsyslog in Ubuntu. https://bugs.launchpad.net/bugs/940030 Title: rsyslog stops working after logrotate until restarted Status in rsyslog package in Ubuntu: Confirmed Bug description: This could otherwise be titled, rsyslog reload does not create log files; only restart does. This is happening on a number of machines I work on. It's happening on 10.04 and 11.04. It might be similar to: https://bugs.launchpad.net/ubuntu/+source/rsyslog/+bug/407862 But in my case after the restart there is no /var/log/syslog being created, nor auth.log, kern.log, etc. The files are rotated, rsyslog is reloaded, and none of the log files are created and nothing is being logged. This has been plaguing my systems since moving from syslog-ng, which I may return to as it seems it was actually production ready. Without manually restarting those files don't exist so here's what I did on an 11.04 system: logrotate --force --verbose /etc/logrotate.conf gives: rotating pattern: /var/log/syslog forced from command line (7 rotations) empty log files are not rotated, old logs are removed considering log /var/log/syslog log /var/log/syslog does not exist -- skipping not running postrotate script, since no logs were rotated rotating pattern: /var/log/mail.info /var/log/mail.warn /var/log/mail.err /var/log/mail.log /var/log/daemon.log /var/log/kern.log /var/log/auth.log /var/log/user.log /var/log/lpr.log /var/log/cron.log /var/log/debug /var/log/messages forced from command line (4 rotations) empty log files are not rotated, old logs are removed considering log /var/log/mail.info log /var/log/mail.info does not exist -- skipping considering log /var/log/mail.warn log /var/log/mail.warn does not exist -- skipping considering log /var/log/mail.err log does not need rotating considering log /var/log/mail.log log does not need rotating considering log /var/log/daemon.log log /var/log/daemon.log does not exist -- skipping considering log /var/log/kern.log log /var/log/kern.log does not exist -- skipping considering log /var/log/auth.log log /var/log/auth.log does not exist -- skipping considering log /var/log/user.log log /var/log/user.log does not exist -- skipping considering log /var/log/lpr.log log /var/log/lpr.log does not exist -- skipping considering log /var/log/cron.log log /var/log/cron.log does not exist -- skipping considering log /var/log/debug log /var/log/debug does not exist -- skipping considering log /var/log/messages log /var/log/messages does not exist -- skipping not running postrotate script, since no logs were rotated Then /sbin/reload rsyslog logger -i testing At this point there is no /var/log/syslog Then: /sbin/restart rsyslog And voila there is a /var/log/syslog beginning with: Feb 23 19:24:48 somehost kernel: imklog 4.6.4, log source = /proc/kmsg started. Feb 23 19:24:48 somehost rsyslogd: [origin software="rsyslogd" swVersion="4.6.4" x-pid="2299" x-info="http://www.rsyslog.com";] (re)start Feb 23 19:24:48 somehost rsyslogd: rsyslogd's groupid changed to 114 Feb 23 19:24:48 somehost rsyslogd: rsyslogd's userid changed to 108 Then to recreate: logrotate --force --verbose /etc/logrotate.conf rotating pattern: /var/log/syslog forced from command line (7 rotations) empty log files are not rotated, old logs are removed considering log /var/log/syslog log needs rotating rotating log /var/log/syslog, log->rotateCount is 7 dateext suffix '-20120223' glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]' compressing log with: /bin/gzip renaming /var/log/syslog to /var/log/syslog-20120223 running postrotate script removing old log /var/log/syslog-20111219.gz rotating pattern: /var/log/mail.info /var/log/mail.warn /var/log/mail.err /var/log/mail.log /var/log/daemon.log /var/log/kern.log /var/log/auth.log /var/log/user.log /var/log/lpr.log /var/log/cron.log /var/log/debug /var/log/messages forced from command line (4 rotations) empty log files are not rotated, old logs are removed considering log /var/log/mail.info log /var/log/mail.info does not exist -- skipping considering log /var/log/mail.warn log /var/log/mail.warn does not exist -- skipping considering log /var/log/mail.err log does not need rotating considering log /var/log/mail.log log does not need rotating considering log /var/log/daemon.log log /var/log/daemon.log does not exist -- skipping considering log /var/log/kern.log log needs rotating considering log /var/log/auth.log log needs rotating considering log /var/log/user.log log /var/log/user.log does not exist -- skipping considering log /var/log/lpr.log log /var/log/lpr.log does not exist -- skipping considering log /var/log/cron.log log /var/log/cron.log does not exist -- skipping considering log /var/log/debug log /var/log/debug does not exist -- skipping considering log /var/log/messages log /var/log/messages does not exist -- skipping rotating log /var/log/kern.log, log->rotateCount is 4 dateext suffix '-20120223' glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]' compressing log with: /bin/gzip rotating log /var/log/auth.log, log->rotateCount is 4 dateext suffix '-20120223' glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]' compressing log with: /bin/gzip renaming /var/log/kern.log to /var/log/kern.log-20120223 renaming /var/log/auth.log to /var/log/auth.log-20120223 running postrotate script removing old log /var/log/kern.log-20111218.gz removing old log /var/log/auth.log-20111218.gz And, what do you know, there is no more /var/log/syslog, auth.log, kern.log, etc. Then /sbin/restart rsyslog and they're there again. I know from the other bug permissions were an issue but they seem not to be in this case: -rw-r----- 1 syslog adm 0 2012-02-23 19:29 auth.log -rw-r----- 1 syslog adm 79 2012-02-23 19:29 kern.log -rw-r----- 1 syslog adm 350 2012-02-23 19:29 syslog In any case, the solution seems to be updating /etc/logrotate.d/rsyslog From: postrotate reload rsyslog >/dev/null 2>&1 || true endscript To: postrotate /sbin/restart rsyslog >/dev/null 2>&1 || true endscript To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/rsyslog/+bug/940030/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
