Re: Duda con logrotate, rsyslog remoto deja de loguear al rotar

[maykel@maykel.sytes.net]

El 2013-05-16 16:00, Camaleón escribió:
> El Thu, 16 May 2013 09:50:36 +0200, maykel escribió:
>
> > El 2013-05-07 16:47, Camaleón escribió:
> > > El Tue, 07 May 2013 11:10:24 +0200, maykel escribió:
> > >
> > > > Hola muy buenas, tengo un servidor remoto rsyslog, el tema es que
> > > > cuando
> > > > rota en una config que le he configurado en
> > > > /etc/logrotate.d/apache-rsyslog, deja de rotar en access.log(que 
> > > > son
> > > > apaches que escriben es este log remoto).
> > >
> > > Esta pregunta me suena... ¿no te pasó algo parecido hace poco? :-?
>
> (...)
>
> > Me paso algo similar en un logrotate que tenía un bug y no me 
> > zipeaba
> > cuando le ponia size determinado. Volviendo al tema.
> >
> > Creo que el problema no es logrotate sino rsyslog. Cuando rota, deja 
> > de
> > loguear en /var/log/remote/access.log. pero si reinicio el rsyslog 
> > ya
> > empieza a loguear correctamente... Imagino que cuando realiza la
> > rotación, hay algo de la configuración que no está fino y rsyslog 
> > deja
> > de loguear...
>
> (...)
>
> >      postrotate
> >          /bin/kill -HUP `cat /var/run/rsyslogd.pid 2> /dev/null` 2> 
> > /dev/null || true
> >      endscript
>
> (...)
>
> Parece que es un bug:
>
> rsyslog stops working after logrotate until restarted
> https://bugs.launchpad.net/ubuntu/+source/rsyslog/+bug/940030
>
> Saludos,
>
> --
> Camaleón


Como siempre, gracias por contestar Camaleón. Lo he cambiado, y lo he 
dejado así:

/var/log/remote/*.log
{
    size 10k
    missingok
    create
    #delaycompres
    delaycompress
    notifempty
    sharedscripts

    postrotate
         /sbin/restart rsyslog >/dev/null 2>&1 || true
    endscript

}

Me gustaría forzarlo para que rote y comprobar que rsyslog se levanta 
bien y sigue logueando...Me devuelve esto la ejecución de logrodate -d 
-f apache-rsyslog:

reading config file /etc/logrotate.d/apache2-rsyslog
reading config info for /var/log/remote/*.log


Handling 1 logs

rotating pattern: /var/log/remote/*.log
 forced from command line (no old logs will be kept)
empty log files are not rotated, old logs are removed
considering log /var/log/remote/access.log
  log needs rotating
considering log /var/log/remote/error.log
  log needs rotating
considering log /var/log/remote/ssl_access.log
  log needs rotating
rotating log /var/log/remote/access.log, log->rotateCount is 0
dateext suffix '-20130520'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
renaming /var/log/remote/access.log.1 to /var/log/remote/access.log.2 
(rotatecount 1, logstart 1, i 1),
renaming /var/log/remote/access.log.0 to /var/log/remote/access.log.1 
(rotatecount 1, logstart 1, i 0),
rotating log /var/log/remote/error.log, log->rotateCount is 0
dateext suffix '-20130520'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
renaming /var/log/remote/error.log.1 to /var/log/remote/error.log.2 
(rotatecount 1, logstart 1, i 1),
renaming /var/log/remote/error.log.0 to /var/log/remote/error.log.1 
(rotatecount 1, logstart 1, i 0),
rotating log /var/log/remote/ssl_access.log, log->rotateCount is 0
dateext suffix '-20130520'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
renaming /var/log/remote/ssl_access.log.1 to 
/var/log/remote/ssl_access.log.2 (rotatecount 1, logstart 1, i 1),
renaming /var/log/remote/ssl_access.log.0 to 
/var/log/remote/ssl_access.log.1 (rotatecount 1, logstart 1, i 0),
renaming /var/log/remote/access.log to /var/log/remote/access.log.1
disposeName will be /var/log/remote/access.log.1
creating new /var/log/remote/access.log mode = 0660 uid = 101 gid = 4
renaming /var/log/remote/error.log to /var/log/remote/error.log.1
disposeName will be /var/log/remote/error.log.1
creating new /var/log/remote/error.log mode = 0660 uid = 101 gid = 4
renaming /var/log/remote/ssl_access.log to 
/var/log/remote/ssl_access.log.1
disposeName will be /var/log/remote/ssl_access.log.1
creating new /var/log/remote/ssl_access.log mode = 0660 uid = 101 gid = 
4
running postrotate script
running script (multiple) with arg /var/log/remote/*.log
: "
         /sbin/restart rsyslog >/dev/null 2>&1 || true
"
removing old log /var/log/remote/access.log.1
removing old log /var/log/remote/error.log.1
removing old log /var/log/remote/ssl_access.log.1


Intento forzarlo con la opción de size 100k, y el fichero access.log 
tiene 120k, debería de rotar...

Saludos.