Re: Strange syslog behaviour [Solved]

[Greg Wooledge <greg@wooledge.org>]

On Sat, Oct 15, 2022 at 01:59:18PM -0400, Wayne Sallee wrote:
>    edit /etc/logrotate.d/rsyslog
>    Change from
>                     invoke-rc.d rsyslog rotate > /dev/null
>    to
>                     /usr/lib/rsyslog/rsyslog-rotate

Hmm.

In /etc/init.d/rsyslog (which is what the old command calls upon), the
rotate action calls this function:

do_rotate() {
        start-stop-daemon --stop --signal HUP --quiet --pidfile $PIDFILE --exec $DAEMON
}

where PIDFILE is defined to be /run/rsyslogd.pid .

This file does not exist on my (bullseye) system, where rsyslog is
started by systemd (/lib/systemd/system/rsyslog.service) with the "-iNONE"
argument, which suppresses the creation of *any* PID file.  So, that
explains why the start-stop-daemon command doesn't work.

Therefore, what you've done looks like the correct fix.  Deleting the
*.dpkg-dist files shouldn't matter, so long as /etc/logrotate.d/rsyslog
gets updated.

However, this looks like a bug in rsyslog to me.

The rsyslog sysv-rc script, if it's going to exist, should duplicate
the /usr/lib/rsyslog/rsyslog-rotate program in the do_rotate function.
It's clearly designed to handle both systemd and sysvinit:

unicorn:~$ less /usr/lib/rsyslog/rsyslog-rotate
#!/bin/sh

if [ -d /run/systemd/system ]; then
    systemctl kill -s HUP rsyslog.service
else
    invoke-rc.d rsyslog rotate > /dev/null
fi

So, the init.d script should be using something like that.  I would do it
like this:

do_rotate() {
	if [ -d /run/systemd/system ]; then
		systemctl kill -s HUP rsyslog.service
	else
		start-stop-daemon --stop --signal HUP --quiet \
			--pidfile "$PIDFILE" --exec "$DAEMON"
	fi
}