Logrotate doesn't rotate well

Latest response

Hi People,

I've been fighting a lot with this problem and no good results.

I want to rotate all the logs coming from network devices.

First day logs are arriving and storaging well, but when it arrives the daily logrotate, logs are still storaging in the old file (the rotated one), leting empty the new one. See the example:

-rwxr-xr-x. 1 root adm 0 oct 15 03:17 cisco.log
-rwxr-xr-x. 1 root adm 74424 oct 15 08:53 cisco.log.1

Do you know what is causing this issue?

I attach my logrotate.conf


see "man logrotate" for details

rotate log files weekly

weekly

keep 4 weeks worth of backlogs

rotate 4

create new (empty) log files after rotating old ones

create

use date as a suffix of the rotated file

dateext

uncomment this if you want your log files compressed

compress

RPM packages drop log rotation information into this directory

include /etc/logrotate.d

no packages own wtmp and btmp -- we'll rotate them here

/var/log/wtmp {
missingok
monthly
create 0664 root utmp
rotate 1
}

/var/log/btmp {
missingok
monthly
create 0660 root utmp
rotate 1
}

system-specific logs may be configured here


/etc/cron.daily/logrotate

!/bin/sh

test -x /usr/sbin/logrotate || exit 0
/usr/sbin/logrotate /etc/logrotate.conf


rsyslog.conf

if $fromhost == 'X.X.X.X' then -/var/log/XXXX/cisco.log
if $fromhost == 'X.X.X.X' then ~


Could you give me some help please? If you need futher infromation, please let me know.

Responses

Assuming that the logs is written by rsyslogd accepting the logs from the remote devices, it's required to send HUP signal into rsyslogd to reopen cisco.log newly created.

Please refer to /etc/logrotate.d/syslog for an example. Maybe, the following lines are required to make it work.

postrotate
    /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
endscript

Hi Masahiro,

Many thanks for your prompt answer. I went to the file you suggested and these lines were in the /etc/logrotate.d/syslog

/var/log/spooler { missingok sharedscripts postrotate /bin/kill -HUP cat /var/run/syslogd.pid 2> /dev/null 2> /dev/null || true endscript

So, probably the issue is from other part from the scripts.

Many thanks

Hi Raúl,

Masahiro gave you good pointers.

a) Can you please confirm in which directory are cisco logs created? It seems you point to:

/var/log/XXXX/cisco.log

b) It seems you did not provide us with the full contents of /etc/logrotate.d/syslog. One would normally expect something like this:

/var/log/cron
/var/log/maillog
/var/log/messages
/var/log/secure
/var/log/spooler
{
    rotate 8
    sharedscripts
    postrotate
        /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
    endscript
}

Can you please clarify if your file looks similar to the above?

Regards,

Dusan Baljevic (amateur radio Vk2COT)

c) Judging by datestamp, it seems cisco.log is rotated around 03:17 hours. Does it happen daily, or weekly, or at some other intervals? How any cisco.log files exist?

d)

Hi Dusan,

Many thanks for your answer.

a) I have verified. Cisco logs are created under the path you mentioned. b) Yes it is similar, just rotate 8 is missing.

c) It has to be rotated daily. It doesn't matter the hour. We want to stroage 30 log cisco files. cisco.log, cisco.log.1, cisco.log.2.gz .... cisco.log.30.gz

Today It has happened a strange thing. I manually ratated two days ago. The "new" logs were redirect to cisco.log (as we want) but yesterday the file doesn't rotate and it's still storaging to cisco.log file instead rotate to cisco.log.1

Many thanks Roger

Hi Roger,

can you provide full contents of /etc/logrotate.d/syslog and also run:

# logrotate -d /etc/logrotate.d/syslog

Also, provide details of how many different logrotate configs exist:

# ls /etc/logrotate.d

Regards,

Dusan Baljevic (amateur radio VK2COT)

Hi Dusan,

Many thanks for your answer! Here you are the information:

vi /etc/logrotate.d/syslog

/var/log/cron
/var/log/maillog
#/var/log/messages
/var/log/secure
/var/log/spooler
{
    missingok
    sharedscripts
    postrotate
        /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
    endscript
}
[root@syslogcom1 roga01c]#  ls -lrr  /etc/logrotate.d
total 72
-rw-r--r--. 1 root root  103 may 17 13:35 yum
-rw-r--r--. 1 root root  100 ago 28  2018 wpa_supplicant
-rw-r--r--. 1 root root   32 dic  9  2013 up2date
-rw-r--r--. 1 root root  225 oct  3 11:23 syslog
-rw-r--r--. 1 root root   71 jun 21 20:43 subscription-manager
-rw-r--r--. 1 root root  237 jun  7 17:09 sssd
-rw-r--r--. 1 root root  115 may 24 09:45 samba
-rw-r-----. 1 root root 2493 oct 16 13:00 rsyslog
-rw-r--r--. 1 root root  408 mar 28  2017 psacct
-rw-r--r--. 1 root root  136 ene 26  2014 ppp
-rw-r--r--. 1 root root  106 nov  7  2017 numad
-rw-r--r--. 1 root root  142 jun 20 14:40 libvirtd.qemu
-rw-r--r--. 1 root root  165 jun 20 14:40 libvirtd
-rw-r--r--. 1 root root  172 sep 29  2016 iscsiuiolog
-rw-r--r--. 1 root root   71 abr 18  2019 cups
-rw-r--r--. 1 root root  160 sep 19  2018 chrony
-rw-r--r--. 1 root root   91 mar 26  2019 bootlog
-rw-r--r--. 1 root root  155 mar 21  2017 aide
[root@syslogcom1 morabanc]# logrotate -d /etc/logrotate.d/syslog
reading config file /etc/logrotate.d/syslog
Allocating hash table for state file, size 15360 B

Handling 1 logs

rotating pattern: /var/log/cron
/var/log/maillog
#/var/log/messages
/var/log/secure
/var/log/spooler
 1048576 bytes (no old logs will be kept)
empty log files are rotated, old logs are removed
considering log /var/log/cron
  log /var/log/cron does not exist -- skipping
considering log /var/log/maillog
  log /var/log/maillog does not exist -- skipping
considering log #/var/log/messages
considering log /var/log/secure
  log /var/log/secure does not exist -- skipping
considering log /var/log/spooler
  log /var/log/spooler does not exist -- skipping
not running postrotate script, since no logs were rotated

Ther logs are still storaging in the old file not in the new.

-rwxr-xr-x. 1 root adm       0 oct 17 03:12 cisco.log
-rwxr-xr-x. 1 root adm  141721 oct 18 12:58 cisco.log.1

Best regards, Roger

Roger--

I see both 'syslog' and 'rsyslog' entries in your /etc/logrotate.d directory, which is a bit confusing. Which version of RHEL is this on, and which logging daemon are you using? (rsyslog or 'old' syslog?) My RHEL 7 systems use 'rsyslogd', but the logroatate.d entry is still called 'syslog' (not rsyslog) - and the pid file /var/run/syslog is for the 'rsyslog' process. Based on your 'ls' output, it looks like the (r)syslog process is not getting the 'kill -HUP' signal from the 'postrotate' section of the logrotate config.

Another thing - I don't see the file 'cisco.log' referenced in the logrotate.d/syslog file above; which file does have 'cisco.log' in it? (should be one of the other files under logrotate.d, or the main /etc/logrotate.conf file).

Hi James. Many thanks for your answer. Oh so do you recomment to erase syslog entry in /etc/logrotate.d? Red Hat Enterprise Linux Server release 7.7

in the /logrotate.d/rsyslog

/var/log/auth.log
/var/log/syslog
/var/log/morabanc/auth.log
/var/log/morabanc/LTM-LC/F5.log
/var/log/morabanc/intrushield.log
/var/log/morabanc/HSM/hsm.log
/var/log/morabanc/juniper-junos.log
/var/log/morabanc/cisco-firewall.log
/var/log/morabanc/juniper-firewall.log
/var/log/morabanc/nessus.log
/var/log/morabanc/DOMINO_NOTES/notes.log
/var/log/morabanc/SNARE/snare.log
/var/log/morabanc/nagios.log
/var/log/morabanc/apache.log
/var/log/morabanc/cisco.log
/var/log/morabanc/COM/sw_distributed_virtual.log
/var/log/morabanc/paloalto_IDS.log

Hi,

I agree with James.

Roger, it does not seem your /etc/logrotate.d/syslog is managing cisco.log files.

Can you show us /etc/logrotate.d/rsyslog?

Regards,

Dusan Baljevic (amateur radio VK2COT)

Hi Dusan,

For sure!

[root@syslogcom1 logrotate.d]# cat /etc/logrotate.d/rsyslog
/var/log/mail.info
/var/log/mail.warn
/var/log/mail.err
/var/log/mail.log
/var/log/daemon.log
/var/log/kern.log
/var/log/user.log
/var/log/lpr.log
/var/log/cron.log
/var/log/debug
/var/log/messages
{
        rotate 7
        weekly
        missingok
        notifempty
        compress
        delaycompress
        sharedscripts
        postrotate
                invoke-rc.d rsyslog reload > /dev/null
        endscript
}

/var/log/auth.log
/var/log/syslog
/var/log/morabanc/auth.log
/var/log/morabanc/LTM-LC/F5.log
/var/log/morabanc/intrushield.log
/var/log/morabanc/HSM/hsm.log
/var/log/morabanc/juniper-junos.log
/var/log/morabanc/cisco-firewall.log
/var/log/morabanc/juniper-firewall.log
/var/log/morabanc/nessus.log
/var/log/morabanc/DOMINO_NOTES/notes.log
/var/log/morabanc/SNARE/snare.log
/var/log/morabanc/nagios.log
/var/log/morabanc/apache.log
/var/log/morabanc/cisco.log
/var/log/morabanc/COM/sw_distributed_virtual.log
/var/log/morabanc/paloalto_IDS.log
/var/log/morabanc/WIFI/cisco-wlc.log
/var/log/morabanc/SISTEMES/aix.log
/var/log/morabanc/COM/3com.log
/var/log/morabanc/COM/sw_blade_fujitsu.log
/var/log/morabanc/COM/WIFI_M96/cisco-wlc.log
/var/log/morabanc/MICRO/controladora_vnx.log
/var/log/morabanc/MICRO/oracle.log
/var/log/morabanc/MUREX/solaris.log
/var/log/morabanc/SISTEMES/pureflex.log
/var/log/morabanc/SISTEMES/nonstop.log
/var/log/morabanc/SISTEMES/caixers.log
/var/log/morabanc/fortinet.log
/var/log/morabanc/UNIX/unix.log
/var/log/morabanc/BLUECOAT/bluecoat.log
/var/log/morabanc/hp.log
/var/log/morabanc/paloalto_traps.log
{
        rotate 30
        daily
        missingok
        notifempty
        delaycompress
        compress
        postrotate
                invoke-rc.d rsyslog reload > /dev/null
        endscript
}

/var/log/morabanc/paloalto.log
{
        rotate 30
        daily
        missingok
        notifempty
        delaycompress
        compress
        postrotate
                invoke-rc.d rsyslog reload > /dev/null
        endscript
}

/var/log/morabanc/paloalto_swift.log
{
        rotate 120
        daily
        missingok
        notifempty
        delaycompress
        compress
        postrotate
                invoke-rc.d rsyslog reload > /dev/null
        endscript
}

/var/log/morabanc/PROVES.log
{
        rotate 30
        size 6M
        #daily
        missingok
        notifempty
        delaycompress
        compress
        postrotate
                invoke-rc.d rsyslog reload > /dev/null
        endscript
}


Hi all! To try it I removed syslog from /etc/logrotate.d/syslog and now when I execute logrotate manually:

[root@syslogcom1 morabanc]# logrotate -d /etc/logrotate.d/rsyslog
reading config file /etc/logrotate.d/rsyslog
Allocating hash table for state file, size 15360 B

Handling 5 logs

rotating pattern: /var/log/mail.info
/var/log/mail.warn
/var/log/mail.err
/var/log/mail.log
/var/log/daemon.log
/var/log/kern.log
/var/log/user.log
/var/log/lpr.log
/var/log/cron.log
/var/log/debug
/var/log/messages
 weekly (7 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/mail.info
  log does not need rotating (log has been rotated at 2019-10-20 3:28, that is not week ago yet)
considering log /var/log/mail.warn
  log does not need rotating (log has been rotated at 2019-10-20 3:28, that is not week ago yet)
considering log /var/log/mail.err
  log /var/log/mail.err does not exist -- skipping
considering log /var/log/mail.log
  log does not need rotating (log has been rotated at 2019-10-20 3:28, that is not week ago yet)
considering log /var/log/daemon.log
  log does not need rotating (log has been rotated at 2019-10-16 13:0, that is not week ago yet)
considering log /var/log/kern.log
  log does not need rotating (log has been rotated at 2019-10-15 3:17, that is not week ago yet)
considering log /var/log/user.log
  log does not need rotating (log has been rotated at 2019-10-20 3:28, that is not week ago yet)
considering log /var/log/lpr.log
  log /var/log/lpr.log does not exist -- skipping
considering log /var/log/cron.log
  log /var/log/cron.log does not exist -- skipping
considering log /var/log/debug
  log does not need rotating (log has been rotated at 2019-10-15 3:17, that is not week ago yet)
considering log /var/log/messages
  log does not need rotating (log has been rotated at 2019-10-20 3:28, that is not week ago yet)
not running postrotate script, since no logs were rotated

rotating pattern: /var/log/auth.log
/var/log/syslog
/var/log/morabanc/auth.log
/var/log/morabanc/LTM-LC/F5.log
/var/log/morabanc/intrushield.log
/var/log/morabanc/HSM/hsm.log
/var/log/morabanc/juniper-junos.log
/var/log/morabanc/cisco-firewall.log
/var/log/morabanc/juniper-firewall.log
/var/log/morabanc/nessus.log
/var/log/morabanc/DOMINO_NOTES/notes.log
/var/log/morabanc/SNARE/snare.log
/var/log/morabanc/nagios.log
/var/log/morabanc/apache.log
/var/log/morabanc/cisco.log
/var/log/morabanc/COM/sw_distributed_virtual.log
/var/log/morabanc/paloalto_IDS.log
/var/log/morabanc/WIFI/cisco-wlc.log
/var/log/morabanc/SISTEMES/aix.log
/var/log/morabanc/COM/3com.log
/var/log/morabanc/COM/sw_blade_fujitsu.log
/var/log/morabanc/COM/WIFI_M96/cisco-wlc.log
/var/log/morabanc/MICRO/controladora_vnx.log
/var/log/morabanc/MICRO/oracle.log
/var/log/morabanc/MUREX/solaris.log
/var/log/morabanc/SISTEMES/pureflex.log
/var/log/morabanc/SISTEMES/nonstop.log
/var/log/morabanc/SISTEMES/caixers.log
/var/log/morabanc/fortinet.log
/var/log/morabanc/UNIX/unix.log
/var/log/morabanc/BLUECOAT/bluecoat.log
/var/log/morabanc/hp.log
/var/log/morabanc/paloalto_traps.log
 after 1 days (30 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/auth.log
  log /var/log/auth.log does not exist -- skipping
considering log /var/log/syslog
  log needs rotating
considering log /var/log/morabanc/auth.log
  log /var/log/morabanc/auth.log does not exist -- skipping
considering log /var/log/morabanc/LTM-LC/F5.log
  log /var/log/morabanc/LTM-LC/F5.log does not exist -- skipping
considering log /var/log/morabanc/intrushield.log
  log /var/log/morabanc/intrushield.log does not exist -- skipping
considering log /var/log/morabanc/HSM/hsm.log
considering log /var/log/morabanc/juniper-junos.log
  log /var/log/morabanc/juniper-junos.log does not exist -- skipping
considering log /var/log/morabanc/cisco-firewall.log
  log /var/log/morabanc/cisco-firewall.log does not exist -- skipping
considering log /var/log/morabanc/juniper-firewall.log
  log /var/log/morabanc/juniper-firewall.log does not exist -- skipping
considering log /var/log/morabanc/nessus.log
  log /var/log/morabanc/nessus.log does not exist -- skipping
considering log /var/log/morabanc/DOMINO_NOTES/notes.log
  log /var/log/morabanc/DOMINO_NOTES/notes.log does not exist -- skipping
considering log /var/log/morabanc/SNARE/snare.log
  log /var/log/morabanc/SNARE/snare.log does not exist -- skipping
considering log /var/log/morabanc/nagios.log
  log /var/log/morabanc/nagios.log does not exist -- skipping
considering log /var/log/morabanc/apache.log
  log /var/log/morabanc/apache.log does not exist -- skipping
considering log /var/log/morabanc/cisco.log
  log needs rotating
considering log /var/log/morabanc/COM/sw_distributed_virtual.log
  log /var/log/morabanc/COM/sw_distributed_virtual.log does not exist -- skipping
considering log /var/log/morabanc/paloalto_IDS.log
  log /var/log/morabanc/paloalto_IDS.log does not exist -- skipping
considering log /var/log/morabanc/WIFI/cisco-wlc.log
considering log /var/log/morabanc/SISTEMES/aix.log
  log /var/log/morabanc/SISTEMES/aix.log does not exist -- skipping
considering log /var/log/morabanc/COM/3com.log
  log /var/log/morabanc/COM/3com.log does not exist -- skipping
considering log /var/log/morabanc/COM/sw_blade_fujitsu.log
  log /var/log/morabanc/COM/sw_blade_fujitsu.log does not exist -- skipping
considering log /var/log/morabanc/COM/WIFI_M96/cisco-wlc.log
  log /var/log/morabanc/COM/WIFI_M96/cisco-wlc.log does not exist -- skipping
considering log /var/log/morabanc/MICRO/controladora_vnx.log
considering log /var/log/morabanc/MICRO/oracle.log
considering log /var/log/morabanc/MUREX/solaris.log
  log /var/log/morabanc/MUREX/solaris.log does not exist -- skipping
considering log /var/log/morabanc/SISTEMES/pureflex.log
  log /var/log/morabanc/SISTEMES/pureflex.log does not exist -- skipping
considering log /var/log/morabanc/SISTEMES/nonstop.log
  log /var/log/morabanc/SISTEMES/nonstop.log does not exist -- skipping
considering log /var/log/morabanc/SISTEMES/caixers.log
  log /var/log/morabanc/SISTEMES/caixers.log does not exist -- skipping
considering log /var/log/morabanc/fortinet.log
  log /var/log/morabanc/fortinet.log does not exist -- skipping
considering log /var/log/morabanc/UNIX/unix.log
  log /var/log/morabanc/UNIX/unix.log does not exist -- skipping
considering log /var/log/morabanc/BLUECOAT/bluecoat.log
  log /var/log/morabanc/BLUECOAT/bluecoat.log does not exist -- skipping
considering log /var/log/morabanc/hp.log
  log /var/log/morabanc/hp.log does not exist -- skipping
considering log /var/log/morabanc/paloalto_traps.log
  log /var/log/morabanc/paloalto_traps.log does not exist -- skipping
rotating log /var/log/syslog, log->rotateCount is 30
dateext suffix '-20191021'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
compressing log with: /bin/gzip
renaming /var/log/syslog.30.gz to /var/log/syslog.31.gz (rotatecount 30, logstart 1, i 30),
renaming /var/log/syslog.29.gz to /var/log/syslog.30.gz (rotatecount 30, logstart 1, i 29),
renaming /var/log/syslog.28.gz to /var/log/syslog.29.gz (rotatecount 30, logstart 1, i 28),
renaming /var/log/syslog.27.gz to /var/log/syslog.28.gz (rotatecount 30, logstart 1, i 27),
renaming /var/log/syslog.26.gz to /var/log/syslog.27.gz (rotatecount 30, logstart 1, i 26),
renaming /var/log/syslog.25.gz to /var/log/syslog.26.gz (rotatecount 30, logstart 1, i 25),
renaming /var/log/syslog.24.gz to /var/log/syslog.25.gz (rotatecount 30, logstart 1, i 24),
renaming /var/log/syslog.23.gz to /var/log/syslog.24.gz (rotatecount 30, logstart 1, i 23),
renaming /var/log/syslog.22.gz to /var/log/syslog.23.gz (rotatecount 30, logstart 1, i 22),
renaming /var/log/syslog.21.gz to /var/log/syslog.22.gz (rotatecount 30, logstart 1, i 21),
renaming /var/log/syslog.20.gz to /var/log/syslog.21.gz (rotatecount 30, logstart 1, i 20),
renaming /var/log/syslog.19.gz to /var/log/syslog.20.gz (rotatecount 30, logstart 1, i 19),
renaming /var/log/syslog.18.gz to /var/log/syslog.19.gz (rotatecount 30, logstart 1, i 18),
renaming /var/log/syslog.17.gz to /var/log/syslog.18.gz (rotatecount 30, logstart 1, i 17),
renaming /var/log/syslog.16.gz to /var/log/syslog.17.gz (rotatecount 30, logstart 1, i 16),
renaming /var/log/syslog.15.gz to /var/log/syslog.16.gz (rotatecount 30, logstart 1, i 15),
renaming /var/log/syslog.14.gz to /var/log/syslog.15.gz (rotatecount 30, logstart 1, i 14),
renaming /var/log/syslog.13.gz to /var/log/syslog.14.gz (rotatecount 30, logstart 1, i 13),
renaming /var/log/syslog.12.gz to /var/log/syslog.13.gz (rotatecount 30, logstart 1, i 12),
renaming /var/log/syslog.11.gz to /var/log/syslog.12.gz (rotatecount 30, logstart 1, i 11),
renaming /var/log/syslog.10.gz to /var/log/syslog.11.gz (rotatecount 30, logstart 1, i 10),
renaming /var/log/syslog.9.gz to /var/log/syslog.10.gz (rotatecount 30, logstart 1, i 9),
renaming /var/log/syslog.8.gz to /var/log/syslog.9.gz (rotatecount 30, logstart 1, i 8),
renaming /var/log/syslog.7.gz to /var/log/syslog.8.gz (rotatecount 30, logstart 1, i 7),
renaming /var/log/syslog.6.gz to /var/log/syslog.7.gz (rotatecount 30, logstart 1, i 6),
renaming /var/log/syslog.5.gz to /var/log/syslog.6.gz (rotatecount 30, logstart 1, i 5),
renaming /var/log/syslog.4.gz to /var/log/syslog.5.gz (rotatecount 30, logstart 1, i 4),
renaming /var/log/syslog.3.gz to /var/log/syslog.4.gz (rotatecount 30, logstart 1, i 3),
renaming /var/log/syslog.2.gz to /var/log/syslog.3.gz (rotatecount 30, logstart 1, i 2),
renaming /var/log/syslog.1.gz to /var/log/syslog.2.gz (rotatecount 30, logstart 1, i 1),
renaming /var/log/syslog.0.gz to /var/log/syslog.1.gz (rotatecount 30, logstart 1, i 0),
fscreate context set to system_u:object_r:var_log_t:s0
renaming /var/log/syslog to /var/log/syslog.1
running postrotate script
running script with arg /var/log/syslog: "
                invoke-rc.d rsyslog reload > /dev/null
"
removing old log /var/log/syslog.31.gz
error: error opening /var/log/syslog.31.gz: No existe el fichero o el directorio
rotating log /var/log/morabanc/cisco.log, log->rotateCount is 30
dateext suffix '-20191021'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
previous log /var/log/morabanc/cisco.log.1 does not exist
renaming /var/log/morabanc/cisco.log.30.gz to /var/log/morabanc/cisco.log.31.gz (rotatecount 30, logstart 1, i 30),
renaming /var/log/morabanc/cisco.log.29.gz to /var/log/morabanc/cisco.log.30.gz (rotatecount 30, logstart 1, i 29),
renaming /var/log/morabanc/cisco.log.28.gz to /var/log/morabanc/cisco.log.29.gz (rotatecount 30, logstart 1, i 28),
renaming /var/log/morabanc/cisco.log.27.gz to /var/log/morabanc/cisco.log.28.gz (rotatecount 30, logstart 1, i 27),
renaming /var/log/morabanc/cisco.log.26.gz to /var/log/morabanc/cisco.log.27.gz (rotatecount 30, logstart 1, i 26),
renaming /var/log/morabanc/cisco.log.25.gz to /var/log/morabanc/cisco.log.26.gz (rotatecount 30, logstart 1, i 25),
renaming /var/log/morabanc/cisco.log.24.gz to /var/log/morabanc/cisco.log.25.gz (rotatecount 30, logstart 1, i 24),
renaming /var/log/morabanc/cisco.log.23.gz to /var/log/morabanc/cisco.log.24.gz (rotatecount 30, logstart 1, i 23),
renaming /var/log/morabanc/cisco.log.22.gz to /var/log/morabanc/cisco.log.23.gz (rotatecount 30, logstart 1, i 22),
renaming /var/log/morabanc/cisco.log.21.gz to /var/log/morabanc/cisco.log.22.gz (rotatecount 30, logstart 1, i 21),
renaming /var/log/morabanc/cisco.log.20.gz to /var/log/morabanc/cisco.log.21.gz (rotatecount 30, logstart 1, i 20),
renaming /var/log/morabanc/cisco.log.19.gz to /var/log/morabanc/cisco.log.20.gz (rotatecount 30, logstart 1, i 19),
renaming /var/log/morabanc/cisco.log.18.gz to /var/log/morabanc/cisco.log.19.gz (rotatecount 30, logstart 1, i 18),
renaming /var/log/morabanc/cisco.log.17.gz to /var/log/morabanc/cisco.log.18.gz (rotatecount 30, logstart 1, i 17),
renaming /var/log/morabanc/cisco.log.16.gz to /var/log/morabanc/cisco.log.17.gz (rotatecount 30, logstart 1, i 16),
renaming /var/log/morabanc/cisco.log.15.gz to /var/log/morabanc/cisco.log.16.gz (rotatecount 30, logstart 1, i 15),
renaming /var/log/morabanc/cisco.log.14.gz to /var/log/morabanc/cisco.log.15.gz (rotatecount 30, logstart 1, i 14),
renaming /var/log/morabanc/cisco.log.13.gz to /var/log/morabanc/cisco.log.14.gz (rotatecount 30, logstart 1, i 13),
renaming /var/log/morabanc/cisco.log.12.gz to /var/log/morabanc/cisco.log.13.gz (rotatecount 30, logstart 1, i 12),
renaming /var/log/morabanc/cisco.log.11.gz to /var/log/morabanc/cisco.log.12.gz (rotatecount 30, logstart 1, i 11),
renaming /var/log/morabanc/cisco.log.10.gz to /var/log/morabanc/cisco.log.11.gz (rotatecount 30, logstart 1, i 10),
renaming /var/log/morabanc/cisco.log.9.gz to /var/log/morabanc/cisco.log.10.gz (rotatecount 30, logstart 1, i 9),
renaming /var/log/morabanc/cisco.log.8.gz to /var/log/morabanc/cisco.log.9.gz (rotatecount 30, logstart 1, i 8),
renaming /var/log/morabanc/cisco.log.7.gz to /var/log/morabanc/cisco.log.8.gz (rotatecount 30, logstart 1, i 7),
renaming /var/log/morabanc/cisco.log.6.gz to /var/log/morabanc/cisco.log.7.gz (rotatecount 30, logstart 1, i 6),
renaming /var/log/morabanc/cisco.log.5.gz to /var/log/morabanc/cisco.log.6.gz (rotatecount 30, logstart 1, i 5),
renaming /var/log/morabanc/cisco.log.4.gz to /var/log/morabanc/cisco.log.5.gz (rotatecount 30, logstart 1, i 4),
renaming /var/log/morabanc/cisco.log.3.gz to /var/log/morabanc/cisco.log.4.gz (rotatecount 30, logstart 1, i 3),
renaming /var/log/morabanc/cisco.log.2.gz to /var/log/morabanc/cisco.log.3.gz (rotatecount 30, logstart 1, i 2),
renaming /var/log/morabanc/cisco.log.1.gz to /var/log/morabanc/cisco.log.2.gz (rotatecount 30, logstart 1, i 1),
renaming /var/log/morabanc/cisco.log.0.gz to /var/log/morabanc/cisco.log.1.gz (rotatecount 30, logstart 1, i 0),
fscreate context set to system_u:object_r:var_log_t:s0
renaming /var/log/morabanc/cisco.log to /var/log/morabanc/cisco.log.1
running postrotate script
running script with arg /var/log/morabanc/cisco.log: "
                invoke-rc.d rsyslog reload > /dev/null
"
removing old log /var/log/morabanc/cisco.log.31.gz
error: error opening /var/log/morabanc/cisco.log.31.gz: No existe el fichero o el directorio

rotating pattern: /var/log/morabanc/paloalto.log
 after 1 days (30 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/morabanc/paloalto.log
  log /var/log/morabanc/paloalto.log does not exist -- skipping

rotating pattern: /var/log/morabanc/paloalto_swift.log
 after 1 days (120 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/morabanc/paloalto_swift.log
  log /var/log/morabanc/paloalto_swift.log does not exist -- skipping

rotating pattern: /var/log/morabanc/PROVES.log
 6291456 bytes (30 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/morabanc/PROVES.log
  log /var/log/morabanc/PROVES.log does not exist -- skipping

But it doesn't generate de cisco.log.1 in

/var/log/morabanc
[root@syslogcom1 morabanc]# ls -ltr
total 56
drwxr-x---. 2 root root     6 oct  2 09:14 SISTEMES
drwxr-x---. 2 root root     6 oct  2 09:14 BLUECOAT
drwxr-x---. 2 root root     6 oct  2 09:14 BBDD
drwxr-x---. 2 root root     6 oct  2 09:14 MUREX
drwxr-x---. 2 root root     6 oct  2 09:15 LTM-LC
drwxr-x---. 2 root root     6 oct  2 09:19 SNARE
drwxr-x---. 2 root root     6 oct  2 09:20 DOMINO_NOTES
drwxr-x---. 2 root root     6 oct  2 09:21 UNIX
drwxr-x---. 3 root root    22 oct  2 09:21 COM
-rwxr-xr-x. 1 root adm  53739 oct 21 16:27 cisco.log

Hi,

So, we now confirm that /etc/logrotate.d/rsyslog is responsible for managing cisco.log.

You ran the command in debug mode, which does not make any changes.

Run this now:

# logrotate -v /etc/logrotate.d/rsyslog

Regards,

Dusan Baljevic (amateur radio VK2COT)

Hi Dusan,

Many thanks for your answer. I done it. The logs are still storaging to cisco.log.1 not in the new one created

[root@syslogcom1 roga01c]# logrotate -v /etc/logrotate.d/rsyslog
reading config file /etc/logrotate.d/rsyslog
Allocating hash table for state file, size 15360 B

Handling 6 logs

rotating pattern: /var/log/mail.info
/var/log/mail.warn
/var/log/mail.err
/var/log/mail.log
/var/log/daemon.log
/var/log/kern.log
/var/log/user.log
/var/log/lpr.log
/var/log/cron.log
/var/log/debug
/var/log/messages
 weekly (7 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/mail.info
  log does not need rotating (log has been rotated at 2019-10-22 9:45, that is not week ago yet)
considering log /var/log/mail.warn
  log does not need rotating (log has been rotated at 2019-10-22 9:45, that is not week ago yet)
considering log /var/log/mail.err
  log /var/log/mail.err does not exist -- skipping
considering log /var/log/mail.log
  log does not need rotating (log has been rotated at 2019-10-22 9:45, that is not week ago yet)
considering log /var/log/daemon.log
  log /var/log/daemon.log does not exist -- skipping
considering log /var/log/kern.log
  log does not need rotating (log is empty)considering log /var/log/user.log
  log does not need rotating (log has been rotated at 2019-10-22 9:45, that is not week ago yet)
considering log /var/log/lpr.log
  log /var/log/lpr.log does not exist -- skipping
considering log /var/log/cron.log
  log /var/log/cron.log does not exist -- skipping
considering log /var/log/debug
  log does not need rotating (log has been rotated at 2019-10-22 3:15, that is not week ago yet)
considering log /var/log/messages
  log does not need rotating (log has been rotated at 2019-10-22 9:48, that is not week ago yet)
not running postrotate script, since no logs were rotated

rotating pattern: /var/log/auth.log
/var/log/syslog
 after 1 days (7 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/auth.log
  log /var/log/auth.log does not exist -- skipping
considering log /var/log/syslog
  log does not need rotating (log is empty)
rotating pattern: /var/log/morabanc/auth.log
/var/log/morabanc/LTM-LC/F5.log
/var/log/morabanc/intrushield.log
/var/log/morabanc/HSM/hsm.log
/var/log/morabanc/juniper-junos.log
/var/log/morabanc/cisco-firewall.log
/var/log/morabanc/juniper-firewall.log
/var/log/morabanc/nessus.log
/var/log/morabanc/DOMINO_NOTES/notes.log
/var/log/morabanc/SNARE/snare.log
/var/log/morabanc/nagios.log
/var/log/morabanc/apache.log
/var/log/morabanc/cisco.log
/var/log/morabanc/COM/sw_distributed_virtual.log
/var/log/morabanc/paloalto_IDS.log
/var/log/morabanc/WIFI/cisco-wlc.log
/var/log/morabanc/SISTEMES/aix.log
/var/log/morabanc/COM/3com.log
/var/log/morabanc/COM/sw_blade_fujitsu.log
/var/log/morabanc/COM/WIFI_M96/cisco-wlc.log
/var/log/morabanc/MICRO/controladora_vnx.log
/var/log/morabanc/MICRO/oracle.log
/var/log/morabanc/MUREX/solaris.log
/var/log/morabanc/SISTEMES/pureflex.log
/var/log/morabanc/SISTEMES/nonstop.log
/var/log/morabanc/SISTEMES/caixers.log
/var/log/morabanc/fortinet.log
/var/log/morabanc/UNIX/unix.log
/var/log/morabanc/BLUECOAT/bluecoat.log
/var/log/morabanc/hp.log
/var/log/morabanc/paloalto_traps.log
 after 1 days (30 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/morabanc/auth.log
  log /var/log/morabanc/auth.log does not exist -- skipping
considering log /var/log/morabanc/LTM-LC/F5.log
  log /var/log/morabanc/LTM-LC/F5.log does not exist -- skipping
considering log /var/log/morabanc/intrushield.log
  log /var/log/morabanc/intrushield.log does not exist -- skipping
considering log /var/log/morabanc/HSM/hsm.log
considering log /var/log/morabanc/juniper-junos.log
  log /var/log/morabanc/juniper-junos.log does not exist -- skipping
considering log /var/log/morabanc/cisco-firewall.log
  log /var/log/morabanc/cisco-firewall.log does not exist -- skipping
considering log /var/log/morabanc/juniper-firewall.log
  log /var/log/morabanc/juniper-firewall.log does not exist -- skipping
considering log /var/log/morabanc/nessus.log
  log /var/log/morabanc/nessus.log does not exist -- skipping
considering log /var/log/morabanc/DOMINO_NOTES/notes.log
  log /var/log/morabanc/DOMINO_NOTES/notes.log does not exist -- skipping
considering log /var/log/morabanc/SNARE/snare.log
  log /var/log/morabanc/SNARE/snare.log does not exist -- skipping
considering log /var/log/morabanc/nagios.log
  log /var/log/morabanc/nagios.log does not exist -- skipping
considering log /var/log/morabanc/apache.log
  log /var/log/morabanc/apache.log does not exist -- skipping
considering log /var/log/morabanc/cisco.log
  log does not need rotating (log is empty)considering log /var/log/morabanc/COM/sw_distributed_virtual.log
  log /var/log/morabanc/COM/sw_distributed_virtual.log does not exist -- skipping
considering log /var/log/morabanc/paloalto_IDS.log
  log /var/log/morabanc/paloalto_IDS.log does not exist -- skipping
considering log /var/log/morabanc/WIFI/cisco-wlc.log
considering log /var/log/morabanc/SISTEMES/aix.log
  log /var/log/morabanc/SISTEMES/aix.log does not exist -- skipping
considering log /var/log/morabanc/COM/3com.log
  log /var/log/morabanc/COM/3com.log does not exist -- skipping
considering log /var/log/morabanc/COM/sw_blade_fujitsu.log
  log /var/log/morabanc/COM/sw_blade_fujitsu.log does not exist -- skipping
considering log /var/log/morabanc/COM/WIFI_M96/cisco-wlc.log
  log /var/log/morabanc/COM/WIFI_M96/cisco-wlc.log does not exist -- skipping
considering log /var/log/morabanc/MICRO/controladora_vnx.log
considering log /var/log/morabanc/MICRO/oracle.log
considering log /var/log/morabanc/MUREX/solaris.log
  log /var/log/morabanc/MUREX/solaris.log does not exist -- skipping
considering log /var/log/morabanc/SISTEMES/pureflex.log
  log /var/log/morabanc/SISTEMES/pureflex.log does not exist -- skipping
considering log /var/log/morabanc/SISTEMES/nonstop.log
  log /var/log/morabanc/SISTEMES/nonstop.log does not exist -- skipping
considering log /var/log/morabanc/SISTEMES/caixers.log
  log /var/log/morabanc/SISTEMES/caixers.log does not exist -- skipping
considering log /var/log/morabanc/fortinet.log
  log /var/log/morabanc/fortinet.log does not exist -- skipping
considering log /var/log/morabanc/UNIX/unix.log
  log /var/log/morabanc/UNIX/unix.log does not exist -- skipping
considering log /var/log/morabanc/BLUECOAT/bluecoat.log
  log /var/log/morabanc/BLUECOAT/bluecoat.log does not exist -- skipping
considering log /var/log/morabanc/hp.log
  log /var/log/morabanc/hp.log does not exist -- skipping
considering log /var/log/morabanc/paloalto_traps.log
  log /var/log/morabanc/paloalto_traps.log does not exist -- skipping

rotating pattern: /var/log/morabanc/paloalto.log
 after 1 days (30 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/morabanc/paloalto.log
  log /var/log/morabanc/paloalto.log does not exist -- skipping

rotating pattern: /var/log/morabanc/paloalto_swift.log
 after 1 days (120 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/morabanc/paloalto_swift.log
  log /var/log/morabanc/paloalto_swift.log does not exist -- skipping

rotating pattern: /var/log/morabanc/PROVES.log
 6291456 bytes (30 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/morabanc/PROVES.log
  log /var/log/morabanc/PROVES.log does not exist -- skipping
set default create context
[root@syslogcom1 roga01c]#
[root@syslogcom1 roga01c]#
[root@syslogcom1 roga01c]# ls -ltr
total 0
[root@syslogcom1 roga01c]# cd /var/log/morabanc/
[root@syslogcom1 morabanc]# ls -ltr
total 156
drwxr-x---. 2 root root      6 oct  2 09:14 SISTEMES
drwxr-x---. 2 root root      6 oct  2 09:14 BLUECOAT
drwxr-x---. 2 root root      6 oct  2 09:14 BBDD
drwxr-x---. 2 root root      6 oct  2 09:14 MUREX
drwxr-x---. 2 root root      6 oct  2 09:15 LTM-LC
drwxr-x---. 2 root root      6 oct  2 09:19 SNARE
drwxr-x---. 2 root root      6 oct  2 09:20 DOMINO_NOTES
drwxr-x---. 2 root root      6 oct  2 09:21 UNIX
drwxr-x---. 3 root root     22 oct  2 09:21 COM
-rwxr-xr-x. 1 root adm       0 oct 23 03:46 cisco.log
-rwxr-xr-x. 1 root adm  158715 oct 24 11:00 cisco.log.1

Hi Roger,

We are getting there :)

Next step, today, do the same step and then restart rsyslog daemon manually:

# logrotate -v /etc/logrotate.d/rsyslog

# service rsyslog restart

If all goes well, you should see logs being listed in /var/log/morabanc/cisco.log.

In that case, it is obvious that the process restarting rsyslog in the logrotate script is not working well.

Maybe try to debug it further by logging rsyslog restart details in a file:

{
        rotate 30
        daily
        missingok
        notifempty
        delaycompress
        compress
        postrotate
                invoke-rc.d rsyslog reload > /SOMELOGFILE
        endscript
}

Regards,

Dusan Baljevic (amateur radio VK2COT)

Hi Dusan,

Many many thanks for your following. I was trying the logrotate during a few days and now it seems that is working properly.

Searching in the internet I found this.

[root@syslogcom1 morabanc]# vi /etc/logrotate.d/rsyslog

.
.
.

/var/log/syslog
{
        rotate 7
        daily
        missingok
        notifempty
        delaycompress
        compress
        create
        postrotate
                /usr/bin/systemctl reload-or-try-restart rsyslog.service
#               invoke-rc.d rsyslog reload > /dev/null
        endscript
}
.
.
.

Including this sentance " /usr/bin/systemctl reload-or-try-restart rsyslog.service"

It worked perfectly

Now I have the logs rotated everyday

Many thanks all of you that have given some help!