Bug#988652: logrotate: kern.log,syslog and other files in /var/log not rotating
> syslog.1 is newer then syslog. So some log messages ended up in syslog, > but rsyslog then continued to write to syslog.1 ? > If you were referring to that problem, can you share what has been > written to syslog and syslog.1? Please take a look on my message from Sat, 22 May 2021 03:18:01 +0200, where I uploaded parts of syslog und syslog.1. The protocols look similar today.The entries in syslog.1 do not end at midnight.
Bug#988652: logrotate: kern.log,syslog and other files in /var/log not rotating
Am 21.05.21 um 05:47 schrieb Uwe Niemeyer:
I adjusted the settings for /etc/logrotate.d/rsyslog
---
/var/log/syslog
/var/log/mail.info
/var/log/mail.warn
/var/log/mail.err
/var/log/mail.log
/var/log/daemon.log
/var/log/kern.log
/var/log/auth.log
/var/log/user.log
/var/log/lpr.log
/var/log/cron.log
/var/log/debug
/var/log/messages
{
rotate 4
daily
missingok
notifempty
compress
delaycompress
sharedscripts
postrotate
/usr/lib/rsyslog/rsyslog-rotate
endscript
}
based on
https://salsa.debian.org/debian/rsyslog/-/commit/651236c2319eb0ca13fd1d376eaf239a6dcd5c49
an with "daily".
The problems outlined are still there :
I guess the relevant part is this:
-rw-r- 1 root adm 606 Mai 21 04:30 messages
-rw-r- 1 root adm 4404 Mai 21 04:00 messages.1
-rw-r- 1 root adm 606 Mai 21 04:30 syslog
-rw-r- 1 root adm 131397 Mai 21 04:55 syslog.1
syslog.1 is newer then syslog. So some log messages ended up in syslog,
but rsyslog then continued to write to syslog.1 ?
If you were referring to that problem, can you share what has been
written to syslog and syslog.1?
OpenPGP_signature
Description: OpenPGP digital signature
Bug#988652: logrotate: kern.log,syslog and other files in /var/log not rotating
With the removed delaycompress-option it is working a little bit better : -rw-r- 1 root adm 0 Mai 22 00:00 kern.log -rw-r- 1 root adm 17152 Mai 21 18:02 kern.log.1.gz -rw-rw-r-- 1 root utmp 298368 Mai 22 02:29 lastlog drwx-- 2 root root 4096 Mai 22 00:55 letsencrypt drwxr-x--- 2 www-data www-data 4096 Mai 21 05:31 lighttpd -rw-r- 1 root adm 0 Okt 18 2020 mail.err -rw-r- 1 root adm 867 Mai 22 01:00 mail.info -rw-r- 1 root adm 462 Mai 21 17:54 mail.info.1.gz -rw-r- 1 root adm 867 Mai 22 01:00 mail.log -rw-r- 1 root adm 462 Mai 21 17:54 mail.log.1.gz -rw-r- 1 root adm 0 Mai 22 00:00 mail.warn -rw-r- 1 root adm 142 Mai 21 17:54 mail.warn.1.gz -rw-r- 1 root adm 154 Mai 22 00:00 messages -rw-r- 1 root adm 17462 Mai 21 21:09 messages.1.gz drwxr-s--- 2 mysql adm 4096 Mai 22 00:00 mysql -rw-r- 1 root www-data 1042 Mai 22 02:00 ncp.log drwxr-xr-x 2 root root 4096 Feb 20 2019 openvpn -rw-r- 1 root adm 54483 Mai 22 02:28 openvpn.log -rw--- 1 root root 669 Mai 22 02:38 openvpn-status.log -rw-r--r-- 1 root root 2516 Feb 15 07:22 pcas.txt -rw--- 1 root root 186 Mai 21 21:21 php7.3-fpm.log drwxr-xr-x 2 pihole pihole 4096 Jun 15 2020 pihole -rw-r--r-- 1 pihole pihole 0 Mai 22 00:00 pihole-FTL.log -rw-r--r-- 1 pihole pihole 11945 Mai 22 00:00 pihole-FTL.log.1 -rw-r--r-- 1 pihole pihole 0 Mai 22 00:00 pihole.log -rw-r--r-- 1 pihole pihole 2156 Mai 22 00:00 pihole.log.1 -rw-r--r-- 1 root root 9908 Mai 16 03:11 pihole_updateGravity.log -rw-r--r-- 1 root root 48265 Mai 15 18:34 popularity-contest -rw-r--r-- 1 root root 16226 Mai 15 18:34 popularity-contest.new.gpg drwx-- 2 root root 4096 Mai 27 2020 private drwxr-s--- 2 redis adm 4096 Mai 21 05:31 redis -rw-r- 1 root adm 23506 Mai 22 01:54 rng.log drwxr-x--- 3 root adm 4096 Mai 18 05:47 samba -rw-r- 1 root adm 16815 Mai 22 02:36 syslog -rw-r- 1 root adm 51224 Mai 22 00:00 syslog.1.gz syslog is starting with: May 22 00:00:02 debian64 rsyslogd: [origin software="rsyslogd" swVersion="8.1901.0" x-pid="6765" x-info="https://www.rsyslog.com;] rsyslogd was HUPed May 22 00:00:02 debian64 systemd[1]: logrotate.service: Succeeded. May 22 00:00:02 debian64 systemd[1]: Started Rotate log files. May 22 00:00:02 debian64 systemd[1]: man-db.service: Succeeded. May 22 00:00:02 debian64 systemd[1]: Started Daily man-db regeneration. May 22 00:01:01 debian64 CRON[10633]: (root) CMD (/root/checkipv6.sh > /dev/null 2>&1) May 22 00:02:01 debian64 CRON[10647]: (root) CMD (/root/checkwebmin.sh > /dev/null 2>&1) May 22 00:05:01 debian64 CRON[10671]: (www-data) CMD (php -f /var/www/nextcloud/cron.php) Notice: The man-db-regeneration succeeded BEFORE starting. I noticed that there are NEW log-entries in the OLD-syslog.1.gz-file which belong to the new day. May 21 23:59:01 debian64 CRON[10390]: (daemon) CMD (test -x /usr/bin/debsecan && /usr/bin/debsecan --cron) May 22 00:00:01 debian64 systemd[1]: Starting Daily man-db regeneration... May 22 00:00:01 debian64 systemd[1]: Starting Rotate log files... May 22 00:00:01 debian64 systemd[1]: Reloading The Apache HTTP Server. May 22 00:00:01 debian64 systemd[1]: Reloaded The Apache HTTP Server. May 22 00:00:01 debian64 CRON[10559]: (root) CMD ( PATH="$PATH:/usr/sbin:/usr/local/bin/" pihole flush once quiet) May 22 00:00:01 debian64 CRON[10564]: (root) CMD ( PATH="$PATH:/usr/sbin:/usr/local/bin/" pihole updatechecker local) May 22 00:00:01 debian64 CRON[10565]: (www-data) CMD (php -f /var/www/nextcloud/cron.php) May 22 00:00:01 debian64 CRON[10567]: (root) CMD (/root/checkfritzreboot.sh > /dev/null 2>&1) May 22 00:00:01 debian64 CRON[10568]: (root) CMD (/root/check6tunnel.sh > /dev/null 2>&1)
Bug#988652: logrotate: kern.log,syslog and other files in /var/log not rotating
Am 21.05.21 um 07:35 schrieb UN-pi: Maybe a helpful idea/reason/solution for the problem? A website in German: https://debianforum.de/forum/viewtopic.php?f=32=180761=syslog Similar symptoms, different cause afaics. OpenPGP_signature Description: OpenPGP digital signature
Bug#988652: logrotate: kern.log,syslog and other files in /var/log not rotating
Maybe a helpful idea/reason/solution for the problem? A website in German: https://debianforum.de/forum/viewtopic.php?f=32=180761=syslog
Bug#988652: logrotate: kern.log,syslog and other files in /var/log not rotating
I adjusted the settings for /etc/logrotate.d/rsyslog
---
/var/log/syslog
/var/log/mail.info
/var/log/mail.warn
/var/log/mail.err
/var/log/mail.log
/var/log/daemon.log
/var/log/kern.log
/var/log/auth.log
/var/log/user.log
/var/log/lpr.log
/var/log/cron.log
/var/log/debug
/var/log/messages
{
rotate 4
daily
missingok
notifempty
compress
delaycompress
sharedscripts
postrotate
/usr/lib/rsyslog/rsyslog-rotate
endscript
}
based on
https://salsa.debian.org/debian/rsyslog/-/commit/651236c2319eb0ca13fd1d376eaf239a6dcd5c49
an with "daily".
The problems outlined are still there :
-rw-r- 1 root adm 606 Mai 21 04:30 kern.log
-rw-r- 1 root adm 3939 Mai 21 04:00 kern.log.1
-rw-rw-r-- 1 root utmp 298368 Mai 21 04:37 lastlog
drwx-- 2 root root 4096 Mai 20 12:14 letsencrypt
drwxr-x--- 2 www-data www-data 4096 Mai 20 06:29 lighttpd
-rw-r--r-- 1 root root 3538 Mai 18 19:17
logsize_180521.txt
-rw-r- 1 root adm 0 Okt 18 2020 mail.err
-rw-r- 1 root adm 796 Mai 21 01:00 mail.info
-rw-r- 1 root adm 796 Mai 21 01:00 mail.log
-rw-r- 1 root adm 0 Mai 20 06:23 mail.warn
-rw-r- 1 root adm 606 Mai 21 04:30 messages
-rw-r- 1 root adm 4404 Mai 21 04:00 messages.1
drwxr-s--- 2 mysql adm 4096 Mai 21 00:00 mysql
-rw-r- 1 root www-data 1984 Mai 21 02:00 ncp.log
drwxr-xr-x 2 root root 4096 Feb 20 2019 openvpn
-rw-r- 1 root adm 17314 Mai 21 04:37 openvpn.log
-rw--- 1 root root 671 Mai 21 04:54
openvpn-status.log
-rw-r--r-- 1 root root 2516 Feb 15 07:22 pcas.txt
drwxr-xr-x 2 pihole pihole 4096 Jun 15 2020 pihole
-rw-r--r-- 1 pihole pihole 0 Mai 21 00:00 pihole-FTL.log
-rw-r--r-- 1 pihole pihole 149 Mai 21 00:00 pihole-FTL.log.1
-rw-r--r-- 1 pihole pihole 0 Mai 17 00:00 pihole.log
-rw-r--r-- 1 root root 9908 Mai 16 03:11
pihole_updateGravity.log
-rw-r--r-- 1 root root 48265 Mai 15 18:34
popularity-contest
-rw-r--r-- 1 root root 16226 Mai 15 18:34
popularity-contest.new.gpg
drwx-- 2 root root 4096 Mai 27 2020 private
drwxr-s--- 2 redis adm 4096 Mai 20 06:29 redis
drwxr-x--- 3 root adm 4096 Mai 18 05:47 samba
-rw-r- 1 root adm 606 Mai 21 04:30 syslog
-rw-r- 1 root adm 131397 Mai 21 04:55 syslog.1
-rw-r- 1 root adm 0 Feb 16 00:00 ufw.log
drwxr-x--- 2 root adm 4096 Mai 20 06:29
unattended-upgrades
-rw-r- 1 root adm 0 Mai 16 00:00 user.log
drwxr-xr-x 2 root root 4096 Jun 15 2020 wicd
-rw-rw-r-- 1 root utmp 4000 Mai 21 04:37 wtmp
It might be helpful to know that my 2 GB Pi4 has "zram.service"
installed as a swap. With no special adjustments for swappiness.
Perhaps that is one of the reasons for the HUP timing problem.
This may make it easier to reproduce the behavior on other computers.
Today I will try to remove the "delaycompress" as described in the posts
and reboot.
Bug#988652: logrotate: kern.log,syslog and other files in /var/log not rotating
Am 20.05.2021 um 06:07 schrieb UN-pi: The actual situation is today the same than yesterday. The system is writing to the old files. using a systemctl kill -s HUP --kill-who=main rsyslog.service didn't help. Ok, that is good, I guess. I would have been suprised if it --kill-who=main would have made a difference. The system was still writing to the old syslog.1-file while the new syslog content's kern.log messages. Only a pkill -HUP rsyslogd helped. I think what you see here is a race condition (i.e. another instance of #720096) and pkill probably slightly changes the timing of how the HUP signal is delivered. I suppose https://salsa.debian.org/debian/rsyslog/-/commit/651236c2319eb0ca13fd1d376eaf239a6dcd5c49 would help as well in you case. Michael
Bug#988652: logrotate: kern.log,syslog and other files in /var/log not rotating
The actual situation is today the same than yesterday. The system is writing to the old files. using a systemctl kill -s HUP --kill-who=main rsyslog.service didn't help. The system was still writing to the old syslog.1-file while the new syslog content's kern.log messages. Only a pkill -HUP rsyslogd helped. the kernel is Linux debian64 5.10.17-v8+ #1414 SMP PREEMPT Fri Apr 30 13:23:25 BST 2021 aarch64 GNU/Linux cat /etc/os-release PRETTY_NAME="Debian GNU/Linux 10 (buster)" NAME="Debian GNU/Linux" VERSION_ID="10" VERSION="10 (buster)" VERSION_CODENAME=buster ID=debian HOME_URL="https://www.debian.org/; SUPPORT_URL="https://www.debian.org/support; BUG_REPORT_URL="https://bugs.debian.org/; -- Looking on a second server with the original /usr/lib/rsyslog/rsyslog-rotate -version and kernel Linux localhost 4.19.0-16-amd64 #1 SMP Debian 4.19.181-1 (2021-03-19) x86_64 GNU/Linux cat /etc/os-release PRETTY_NAME="Debian GNU/Linux 10 (buster)" NAME="Debian GNU/Linux" VERSION_ID="10" VERSION="10 (buster)" VERSION_CODENAME=buster ID=debian HOME_URL="https://www.debian.org/; SUPPORT_URL="https://www.debian.org/support; BUG_REPORT_URL="https://bugs.debian.org/; Here everything works fine.
Bug#988652: logrotate: kern.log,syslog and other files in /var/log not rotating
Thanks for the killall-warning. I tried the different commands in the terminal. systemctl kill -s HUP rsyslog.service 2 lines with HUP-notice are shown in syslog. systemctl kill -s HUP --kill-who=main rsyslog.service 2 lines with HUP-notice are shown in syslog. pkill -HUP rsyslogd 4 lines with HUP-notice are shown in syslog. There is 1 main process and 3 childs.
Bug#988652: logrotate: kern.log,syslog and other files in /var/log not rotating
Am 19.05.21 um 12:27 schrieb UN-pi: I found this in the internet: https://github.com/rsyslog/rsyslog/issues/3952 I will give it a try by changing |#!/bin/sh if [ -d /run/systemd/system ]; then systemctl kill -s HUP rsyslog.service else invoke-rc.d rsyslog rotate > /dev/null fi to ||#!/bin/sh if [ -d /run/systemd/system ]; then ||killall -HUP rsyslogd else ||killall -HUP rsyslogd fi Then I manually restarted the rsyslog.service and startet journalctl --rotate. I will see. ||| While you can test this, I'm certainly not going to use "killall" in logrotate.d/rsyslog, as it is dangerous. OpenPGP_signature Description: OpenPGP digital signature
Bug#988652: logrotate: kern.log,syslog and other files in /var/log not rotating
I found this in the internet: https://github.com/rsyslog/rsyslog/issues/3952 I will give it a try by changing |#!/bin/sh if [ -d /run/systemd/system ]; then systemctl kill -s HUP rsyslog.service else invoke-rc.d rsyslog rotate > /dev/null fi to ||#!/bin/sh if [ -d /run/systemd/system ]; then ||killall -HUP rsyslogd else ||killall -HUP rsyslogd fi Then I manually restarted the rsyslog.service and startet journalctl --rotate. I will see. |||
Bug#988652: logrotate: kern.log,syslog and other files in /var/log not rotating
A morning surprise: After I reset the / usr/ lib/ rsyslog /rsyslog-rotate fileto the original-version the content of kern.log, syslog and messages is almost identical. The syslog file seems to be rotated, but thesystem is writing to syslog.1 while the syslog-file has kern.log-content.Currently the content of the 3 files kern.log, syslog and messages is almost identical. I tried to restart with systemtl restart rsyslogd.service = no effect journalctl --rotate = no effect syslog.1: May 19 06:59:01 debian64 CRON[865]: (daemon) CMD (test -x /usr/bin/debsecan && /usr/bin/debsecan --cron) May 19 07:00:01 debian64 CRON[880]: (root) CMD ( PATH="$PATH:/usr/sbin:/usr/local/bin/" pihole updatechecker local) May 19 07:00:01 debian64 CRON[881]: (www-data) CMD (php -f /var/www/nextcloud/cron.php) May 19 07:00:01 debian64 CRON[882]: (root) CMD (/root/check6tunnel.sh > /dev/null 2>&1) May 19 07:00:01 debian64 CRON[885]: (root) CMD (/root/checkfritzreboot.sh > /dev/null 2>&1) May 19 07:00:01 debian64 systemd[11441]: mnt-fritznas.mount: Succeeded. May 19 07:00:01 debian64 systemd[1]: mnt-fritznas.mount: Succeeded. May 19 07:00:01 debian64 systemd[607]: mnt-fritznas.mount: Succeeded. May 19 07:01:01 debian64 CRON[925]: (root) CMD (/root/checkipv6.sh > /dev/null 2>&1) May 19 07:02:01 debian64 CRON[1076]: (root) CMD (/root/checkwebmin.sh > /dev/null 2>&1) May 19 07:03:27 debian64 dhcpcd[383]: eth0: Router Advertisement from fe80::2e91:abff:123:e8b2 May 19 07:05:01 debian64 CRON[1120]: (www-data) CMD (php -f /var/www/nextcloud/cron.php) May 19 07:06:27 debian64 dhcpcd[383]: eth0: Router Advertisement from fe80::2e91:abff:123:e8b2 May 19 07:09:00 debian64 systemd[1]: Starting Clean php session files... May 19 07:09:00 debian64 systemd[1]: phpsessionclean.service: Succeeded. May 19 07:09:00 debian64 systemd[1]: Started Clean php session files. May 19 07:09:01 debian64 CRON[1286]: (root) CMD ( [ -x /usr/lib/php/sessionclean ] && if [ ! -d /run/systemd/system ]; then /usr/lib/php/sessionclean; fi) May 19 07:10:01 debian64 CRON[1415]: (root) CMD ( PATH="$PATH:/usr/sbin:/usr/local/bin/" pihole updatechecker local) May 19 07:10:01 debian64 CRON[1416]: (www-data) CMD (php -f /var/www/nextcloud/cron.php) May 19 07:15:01 debian64 CRON[1545]: (www-data) CMD (php -f /var/www/nextcloud/cron.php) May 19 07:16:16 debian64 dhcpcd[383]: eth0: Router Advertisement from fe80::2e91:abff:123:e8b2 May 19 07:17:01 debian64 CRON[1576]: (root) CMD ( cd / && run-parts --report /etc/cron.hourly) May 19 07:18:20 debian64 systemd[1]: Stopping System Logging Service... May 19 07:18:20 debian64 rsyslogd: [origin software="rsyslogd" swVersion="8.1901.0" x-pid="302" x-info="https://www.rsyslog.com;] exiting on signal 15. May 19 07:18:20 debian64 systemd[1]: rsyslog.service: Succeeded. May 19 07:18:20 debian64 systemd[1]: Stopped System Logging Service. May 19 07:18:20 debian64 systemd[1]: Starting System Logging Service... May 19 07:18:20 debian64 rsyslogd: imuxsock: Acquired UNIX socket '/run/systemd/journal/syslog' (fd 3) from systemd. [v8.1901.0] May 19 07:18:20 debian64 rsyslogd: [origin software="rsyslogd" swVersion="8.1901.0" x-pid="1593" x-info="https://www.rsyslog.com;] start May 19 07:18:20 debian64 systemd[1]: Started System Logging Service. May 19 07:20:01 debian64 CRON[1614]: (www-data) CMD (php -f /var/www/nextcloud/cron.php) May 19 07:20:01 debian64 CRON[1613]: (root) CMD ( PATH="$PATH:/usr/sbin:/usr/local/bin/" pihole updatechecker local) May 19 07:24:10 debian64 dhcpcd[383]: eth0: Router Advertisement from fe80::2e91:abff:123:e8b2 May 19 07:25:01 debian64 CRON[1810]: (www-data) CMD (php -f /var/www/nextcloud/cron.php) May 19 07:25:12 debian64 dhcpcd[383]: eth0: Router Advertisement from fe80::2e91:abff:123:e8b2 --- syslog: May 19 00:30:01 debian64 kernel: [543701.990594] CIFS: Attempting to mount //fritz.box/fritz.nas/ May 19 01:00:01 debian64 kernel: [545501.705868] CIFS: Attempting to mount //fritz.box/fritz.nas/ May 19 02:30:01 debian64 kernel: [550902.133413] CIFS: Attempting to mount //fritz.box/fritz.nas/ May 19 03:00:02 debian64 kernel: [552702.512337] CIFS: Attempting to mount //fritz.box/fritz.nas/ May 19 05:00:01 debian64 kernel: [559902.394223] CIFS: Attempting to mount //fritz.box/fritz.nas/ May 19 05:30:01 debian64 kernel: [561701.838038] CIFS: Attempting to mount //fritz.box/fritz.nas/ May 19 07:00:01 debian64 kernel: [567102.215190] CIFS: Attempting to mount //fritz.box/fritz.nas/ messages: May 18 16:22:24 debian64 rsyslogd: [origin software="rsyslogd" swVersion="8.1901.0"
Bug#988652: logrotate: kern.log,syslog and other files in /var/log not rotating
Yes, it is very easy.But I think that I will only be able to see in a few days whether the old behavior will return.Please be patient. On Tue, 18 May 2021 18:18:37 +0200 Michael Biebl wrote: > Am 18.05.21 um 17:05 schrieb Michael Biebl: > > Am 18.05.21 um 16:37 schrieb UN-pi: > >> "systemctl status rsyslog.service" say: > >> > >> rsyslog.service - System Logging Service > >> Loaded: loaded (/lib/systemd/system/rsyslog.service; enabled; vendor > >> preset: enabled) > >> Active: active (running) since Wed 2021-05-12 17:27:41 CEST;5 days > >> ago > >> Docs: man:rsyslogd(8) > >> https://www.rsyslog.com/doc/ > >> Main PID: 302 (rsyslogd) > >> Tasks: 4 (limit: 1968) > >> CGroup: /system.slice/rsyslog.service > >> └─302 /usr/sbin/rsyslogd -n -iNONE > >> > > > > Ok, so you have single process. I don't see how --kill-who=main is going > > to make a difference here. > > > > Could you switch back to the original version without "--kill-who=main" > > and verify that this reintroduces the problem for you? >
Bug#988652: logrotate: kern.log,syslog and other files in /var/log not rotating
Am 18.05.21 um 17:05 schrieb Michael Biebl: Am 18.05.21 um 16:37 schrieb UN-pi: "systemctl status rsyslog.service" say: rsyslog.service - System Logging Service Loaded: loaded (/lib/systemd/system/rsyslog.service; enabled; vendor preset: enabled) Active: active (running) since Wed 2021-05-12 17:27:41 CEST;5 days ago Docs: man:rsyslogd(8) https://www.rsyslog.com/doc/ Main PID: 302 (rsyslogd) Tasks: 4 (limit: 1968) CGroup: /system.slice/rsyslog.service └─302 /usr/sbin/rsyslogd -n -iNONE Ok, so you have single process. I don't see how --kill-who=main is going to make a difference here. Could you switch back to the original version without "--kill-who=main" and verify that this reintroduces the problem for you? OpenPGP_signature Description: OpenPGP digital signature
Bug#988652: logrotate: kern.log,syslog and other files in /var/log not rotating
Control: notfixed -1 logrotate/3.18.0-2 Control: reassign -1 src:rsyslog Control: tags -1 -newcomer Control: affects -1 logrotate > I noticed that some log files in /var/log are not being rotated. > e.g. kern.log, syslog etc. > There are no files ending with .1 or .gz. The files keep getting bigger. > Are there any relevant logs from logrotate (i.e. `journalctl -u logrotate`)? Do you still have a system with this issue and be able to run `logrotate -v /etc/logrotate.conf` on it? > I found on the internet: > https://askubuntu.com/questions/695999/var-log-syslog-not-rotating. > > After I make the change it seems to work. > Extract from the website: > " > Based on Samuel's comment, modified /usr/lib/rsyslog/rsyslog-rotate > #!/bin/sh > > if [-d /run/systemd/system]; then > systemctl kill -s HUP --kill-who = main rsyslog.service > else > invoke-rc.d rsyslog rotate> /dev/null > fi > " > > Is it a bug or do I have an understanding problem somewhere? > I am not quite sure why changing this script resolved your issue, it might solve rsyslog writing to the old log files but logrotate should have created a `.1` file. As the configuration of kern.log and syslog in /etc/logrotate.d/rsyslog and the script /usr/lib/rsyslog/rsyslog-rotate are part of src:rsyslog, I am reassigning the bug. p.s.: the tag newcomer is meant for bugs to be resolved by newcomers, see https://www.debian.org/Bugs/Developer#tags
Bug#988652: logrotate: kern.log,syslog and other files in /var/log not rotating
Am 18.05.21 um 16:37 schrieb UN-pi: "systemctl status rsyslog.service" say: rsyslog.service - System Logging Service Loaded: loaded (/lib/systemd/system/rsyslog.service; enabled; vendor preset: enabled) Active: active (running) since Wed 2021-05-12 17:27:41 CEST;5 days ago Docs: man:rsyslogd(8) https://www.rsyslog.com/doc/ Main PID: 302 (rsyslogd) Tasks: 4 (limit: 1968) CGroup: /system.slice/rsyslog.service └─302 /usr/sbin/rsyslogd -n -iNONE Ok, so you have single process. I don't see how --kill-who=main is going to make a difference here. OpenPGP_signature Description: OpenPGP digital signature
Bug#988652: logrotate: kern.log,syslog and other files in /var/log not rotating
"systemctl status rsyslog.service" say: rsyslog.service - System Logging Service Loaded: loaded (/lib/systemd/system/rsyslog.service; enabled; vendor preset: enabled) Active: active (running) since Wed 2021-05-12 17:27:41 CEST; 5 days ago Docs: man:rsyslogd(8) https://www.rsyslog.com/doc/ Main PID: 302 (rsyslogd) Tasks: 4 (limit: 1968) CGroup: /system.slice/rsyslog.service └─302 /usr/sbin/rsyslogd -n -iNONE Mai 16 00:00:03 debian64 rsyslogd[302]: [origin software="rsyslogd" swVersion="8.1901.0" x-pid="302" x-info="https://www.rsyslog.com;] rsyslogd was HUPed Mai 16 00:00:03 debian64 rsyslogd[302]: [origin software="rsyslogd" swVersion="8.1901.0" x-pid="302" x-info="https://www.rsyslog.com;] rsyslogd was HUPed Mai 17 00:00:03 debian64 rsyslogd[302]: [origin software="rsyslogd" swVersion="8.1901.0" x-pid="302" x-info="https://www.rsyslog.com;] rsyslogd was HUPed Mai 18 00:00:02 debian64 rsyslogd[302]: [origin software="rsyslogd" swVersion="8.1901.0" x-pid="302" x-info="https://www.rsyslog.com;] rsyslogd was HUPed Warning: Journal has been rotated since unit was started. Log output is incomplete or unavailable. -- The htop-program has 1 main task and 3 childs.
Bug#988652: logrotate: kern.log,syslog and other files in /var/log not rotating
Am 18.05.2021 um 16:13 schrieb Michael Biebl: --- So I added : --kill-who=main -- Ok, thanks for the additional information. I don't see how this is going to fix your issue though. Typically, rsyslog only has a single process, so using main or all shouldn't really make any difference. If you run "systemctl status rsyslog.service", does it show more then one process? Can you paste the output please. Fwiw, adding --kill-who=main is probably not a bad idea in itself and it probably makes sense to do so. But I don't see, how this is fixing your issue.
Bug#988652: logrotate: kern.log,syslog and other files in /var/log not rotating
[please always CC the bug report on replies] Am 18.05.2021 um 15:58 schrieb UN-pi: This was the original file: --- #!/bin/sh if [ -d /run/systemd/system ]; then systemctl kill -s HUP rsyslog.service else invoke-rc.d rsyslog rotate > /dev/null fi -- I commented out the lines with # and added a memo for me for UNDO reasons. - #!/bin/sh #based on #https://askubuntu.com/questions/695999/var-log-syslog-not-rotating #if [ -d /run/systemd/system ]; then # systemctl kill -s HUP rsyslog.service #else # invoke-rc.d rsyslog rotate > /dev/null #fi if [ -d /run/systemd/system ]; then systemctl kill -s HUP --kill-who=main rsyslog.service else invoke-rc.d rsyslog rotate > /dev/null fi --- So I added : --kill-who=main -- Ok, thanks for the additional information. I don't see how this is going to fix your issue though. Typically, rsyslog only has a single process, so using main or all shouldn't really make any difference. If you run "systemctl status rsyslog.service", does it show more then one process? Can you paste the output please. OpenPGP_signature Description: OpenPGP digital signature
Bug#988652: logrotate: kern.log,syslog and other files in /var/log not rotating
Am 18.05.2021 um 15:05 schrieb UN-pi: On Tue, 18 May 2021 14:23:14 +0200 Michael Biebl wrote: > What exactly did you change in the script? Please post a diff (or the > file before and after the modifications you did). > > This is my actual file: #!/bin/sh #based on #https://askubuntu.com/questions/695999/var-log-syslog-not-rotating #if [ -d /run/systemd/system ]; then # systemctl kill -s HUP rsyslog.service #else # invoke-rc.d rsyslog rotate > /dev/null #fi if [ -d /run/systemd/system ]; then systemctl kill -s HUP --kill-who=main rsyslog.service else invoke-rc.d rsyslog rotate > /dev/null fi What was the file before the change (i.e. the file which triggered this problem)?
Bug#988652: logrotate: kern.log,syslog and other files in /var/log not rotating
On Tue, 18 May 2021 14:23:14 +0200 Michael Biebl wrote: > On Tue, 18 May 2021 14:10:08 +0200 =?UTF-8?Q?Christian_G=C3=B6ttsche?= > wrote: > > > Based on Samuel's comment, modified /usr/lib/rsyslog/rsyslog-rotate > > > #!/bin/sh > > > > > > if [-d /run/systemd/system]; then > > > systemctl kill -s HUP --kill-who = main rsyslog.service > > > else > > > invoke-rc.d rsyslog rotate> /dev/null > > > fi > > > " > > > > > > Is it a bug or do I have an understanding problem somewhere? > > > > > What exactly did you change in the script? Please post a diff (or the > file before and after the modifications you did). > > This is my actual file: #!/bin/sh #based on #https://askubuntu.com/questions/695999/var-log-syslog-not-rotating #if [ -d /run/systemd/system ]; then # systemctl kill -s HUP rsyslog.service #else # invoke-rc.d rsyslog rotate > /dev/null #fi if [ -d /run/systemd/system ]; then systemctl kill -s HUP --kill-who=main rsyslog.service else invoke-rc.d rsyslog rotate > /dev/null fi - logrotate -v /etc/logrotate.conf is running journalctl -u logrotate says: -- Logs begin at Sat 2021-05-15 07:00:01 CEST, end at Tue 2021-05-18 14:51:27 CEST. -- Mai 16 00:00:01 debian64 systemd[1]: Starting Rotate log files... Mai 16 00:00:03 debian64 systemd[1]: logrotate.service: Succeeded. Mai 16 00:00:03 debian64 systemd[1]: Started Rotate log files. Mai 17 00:00:01 debian64 systemd[1]: Starting Rotate log files... Mai 17 00:00:03 debian64 systemd[1]: logrotate.service: Succeeded. Mai 17 00:00:03 debian64 systemd[1]: Started Rotate log files. Mai 18 00:00:01 debian64 systemd[1]: Starting Rotate log files... Mai 18 00:00:02 debian64 systemd[1]: logrotate.service: Succeeded. Mai 18 00:00:02 debian64 systemd[1]: Started Rotate log files. It is the first time that I have made such a report via reportbug. I can only hope that I comply with the reporting rules to some extent.
Bug#988652: logrotate: kern.log,syslog and other files in /var/log not rotating
On Tue, 18 May 2021 14:10:08 +0200 =?UTF-8?Q?Christian_G=C3=B6ttsche?= wrote: > Based on Samuel's comment, modified /usr/lib/rsyslog/rsyslog-rotate > #!/bin/sh > > if [-d /run/systemd/system]; then > systemctl kill -s HUP --kill-who = main rsyslog.service > else > invoke-rc.d rsyslog rotate> /dev/null > fi > " > > Is it a bug or do I have an understanding problem somewhere? > What exactly did you change in the script? Please post a diff (or the file before and after the modifications you did).
Bug#988652: logrotate: kern.log,syslog and other files in /var/log not rotating
Package: logrotate Version: 3.14.0-4 Severity: normal Tags: newcomer Dear Maintainer, I noticed that some log files in /var/log are not being rotated. e.g. kern.log, syslog etc. There are no files ending with .1 or .gz. The files keep getting bigger. I found on the internet: https://askubuntu.com/questions/695999/var-log-syslog-not-rotating. After I make the change it seems to work. Extract from the website: " Based on Samuel's comment, modified /usr/lib/rsyslog/rsyslog-rotate #!/bin/sh if [-d /run/systemd/system]; then systemctl kill -s HUP --kill-who = main rsyslog.service else invoke-rc.d rsyslog rotate> /dev/null fi " Is it a bug or do I have an understanding problem somewhere? -- Package-specific info: Contents of /etc/logrotate.d total 100 -rw-r--r-- 1 root root 120 Apr 19 2019 alternatives -rw-r--r-- 1 root root 442 Jun 18 2020 apache2 -rw-r--r-- 1 root root 173 May 28 2019 apt -rw-r--r-- 1 root root 79 Feb 13 2019 aptitude -rw-r--r-- 1 root root 297 Aug 20 2019 asterisk -rw-r--r-- 1 root root 130 Aug 29 2018 btmp -rw-r--r-- 1 root root 82 May 26 2018 certbot -rw-r--r-- 1 root root 112 Apr 19 2019 dpkg -rw-r--r-- 1 root root 313 Apr 4 2018 fail2ban -rw-r--r-- 1 root root 234 Mar 1 2018 iaxmodem -rw-r--r-- 1 root root 419 Jan 28 2019 lighttpd -rw-r--r-- 1 root root 97 Jun 18 2020 log2ram -rw-r--r-- 1 root root 802 Jan 29 2020 mysql-server -r--r--r-- 1 root root 111 May 15 07:45 ncp -rw-r--r-- 1 root root 182 Nov 11 2020 openvpn -rw-r--r-- 1 root root 155 Oct 26 2019 php7.3-fpm -rw-r--r-- 1 root root 1029 Jan 25 2019 psaccs_atop -rw-r--r-- 1 root root 541 Jan 25 2019 psaccu_atop -rw-r--r-- 1 root root 124 Jul 10 2019 redis-server -rw-r--r-- 1 root root 501 Feb 26 2019 rsyslog -rw-r--r-- 1 root root 891 Sep 2 2019 samba -rw-r--r-- 1 root root 188 Jun 15 2020 ufw -rw-r--r-- 1 root root 235 Jun 8 2019 unattended-upgrades -rw-r--r-- 1 root root 305 Sep 2 2019 winbind -rw-r--r-- 1 root root 145 Feb 19 2018 wtmp -- System Information: Debian Release: 10.9 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable') Architecture: arm64 (aarch64) Foreign Architectures: armhf Kernel: Linux 5.10.17-v8+ (SMP w/4 CPU cores; PREEMPT) Kernel taint flags: TAINT_CRAP Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8) (ignored: LC_ALL set to de_DE.UTF-8), LANGUAGE=de_DE.UTF-8 (charmap=UTF-8) (ignored: LC_ALL set to de_DE.UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) Versions of packages logrotate depends on: ii cron [cron-daemon] 3.0pl1-134+deb10u1 ii libacl1 2.2.53-4 ii libc6 2.28-10 ii libpopt01.16-12 ii libselinux1 2.8-1+b1 ii systemd-sysv241-7~deb10u7 Versions of packages logrotate recommends: ii bsd-mailx [mailx] 8.1.2-0.20180807cvs-1 logrotate suggests no packages. -- no debconf information
