I have systems (armbian) that had anomalous behaviour.
This included sometimes writing to /var/log/syslog.1 rather than to /var/log/syslog (which was created, but zero size)
Additionally the logrotate was happening daily or twice daily when seemingly configured for weekly rotates
Anyway long story short, at some stage some package updates must have written an extra file into /etc/logrotate.d that had duplicate entries to the normal files.
This was interpreted by the logrotate process as well as the intended files such as /etc/logrotated.d/rsyslog
On one system this unexpected file was called rsyslog.dpkg-old on another system it was rsyslog.dpkg-dist
Removing these files ( but not /etc/logrotate.d/dpkg ) now has a correctly configured log rotation
-- Jeremy
OpenPGP_signature
Description: OpenPGP digital signature
