On Mon 11 Apr 2022 at 10:07:53 (+0800), Jeremy Ardley wrote: > I have systems (armbian) that had anomalous behaviour. > > This included sometimes writing to /var/log/syslog.1 rather than to > /var/log/syslog (which was created, but zero size) > > Additionally the logrotate was happening daily or twice daily when > seemingly configured for weekly rotates > > Anyway long story short, at some stage some package updates must have > written an extra file into /etc/logrotate.d that had duplicate entries > to the normal files. > > This was interpreted by the logrotate process as well as the intended > files such as /etc/logrotated.d/rsyslog
So presumably one instance was still writing to /var/log/syslog when the other one rotated it and created a new one. > On one system this unexpected file was called rsyslog.dpkg-old on > another system it was rsyslog.dpkg-dist Should we assume that you know how these files came to be present, ie that rsyslog had been modified, after which, during upgrading, apt had been given the responses "keep the old one" (Debian's new version becomes ….dpkg-dist) and "replace by the new one (your old version is renamed ….dpkg-old). > Removing these files ( but not /etc/logrotate.d/dpkg ) now has a > correctly configured log rotation There are tabooext and taboopat directives for ignoring files in logrotated.d, and I would have thought it reasonable to exclude these sorts of housekeeping files by default, because they're very likely to contain some duplication. I would file a bug against logrotate. Cheers, David.
