logrotate Log Rotate Configuration

Some older versions of rsyslog may have trouble resuming on a log file after the log rotate has run. We can force rsyslog to pick up the new log file by adding a postrotate command in logrotate. This will restart rsyslog and delete the state files so it will continue reading from the beginning of the newly created file.

Log Rotate Setup

1. Open the logrotate configuration file

Configuration files are located in this directory on most linux distributions

cd /etc/logrotate.d

Find the appropriate configuration file and open it with a text editor. In this example, we’ll use the nginx log files.

sudo vim nginx

You will see the default configuration given below

/var/log/nginx/*.log {
        daily
        missingok
        rotate 52
        compress
        delaycompress
        notifempty
        create 640 nginx adm
        sharedscripts
        postrotate
                [ -f /var/run/nginx.pid ] && kill -USR1 `cat /var/run/nginx.pid`
        endscript
}

All the commands written between the postrotate and endscript gets executed after each log rotation. In this example, we can see that nginx is restarted. We will add additional commands here soon.

2. Find your rsyslog state files

Find the files rsyslog writes to track the state of the files are monitoring. We will configure the postrotate command to delete these configuration files so rsyslog starts fresh at the beginning of the new log file. If you used the configure-file-monitoring script, it will include the alias you passed as a parameter.

ls /var/spool/rsyslog/stat-*

Here we can see two state files for nginx

/var/spool/rsyslog/stat-nginx-access
/var/spool/rsyslog/stat-nginx-error

3. Add postrotate commands

Add the following commands in the postrotate section to restart rsyslog and delete the state files. Replace the path given to the rm command with the path to the rsyslog state files found above. In this example, we are deleting the state files for nginx.

rm /var/spool/rsyslog/stat-*
service rsyslog stop
service rsyslog start

Advanced Log Rotate Options

Troubleshooting Your Log Rotate Configuration

If you don’t see any data show up in the verification step, then check for these common problems.

  • Wait a few minutes in case indexing needs to catch up
  • If you see duplicate events send to Loggly, check to see if you accidentally deleted the wrong state files. Also check to make sure a new file of zero length is created after the log rotation runs.
  • Make sure the state files are deleted and recreated after rsyslog restarts
  • Troubleshooting Rsyslog if the files are being written but not being sent to Loggly
  • Search or post your own question in the community forum.
0 (0)
Article Rating (No Votes)
Rate this article
Attachments
There are no attachments for this article.
Comments
There are no comments for this article. Be the first to post a comment.
Full Name
Email Address
Security Code Security Code
Related Articles RSS Feed
Need to set up yum repository for locally-mounted DVD on Red Hat Enterprise Linux 7
Viewed 2240 times since Mon, Oct 29, 2018
Exclude multiple files and directories with rsync
Viewed 1648 times since Wed, Oct 31, 2018
ZFS: Create a new zfs filesystem
Viewed 1929 times since Sun, Jun 3, 2018
Procedura powiekszania OCFS2 online
Viewed 4845 times since Fri, Jun 8, 2018
LVM: Extend an existing Volume Group by adding a new disk
Viewed 1368 times since Sat, Jun 2, 2018
Using renice and taskset to manage process priority and CPU affinity with Linux OEL 6.4
Viewed 2710 times since Mon, Feb 17, 2020
HOWTO: Use SSL/port 465 in smarthost stunnel
Viewed 2858 times since Fri, Sep 28, 2018
Telnet – Send GET/HEAD HTTP Request
Viewed 2362 times since Mon, Feb 18, 2019
zabbix linux How to solve apache error No space left on device: Cannot create SSLMutex
Viewed 1056 times since Wed, Nov 11, 2020
How to Install and use Lsyncd on CentOS 7 / RHEL 7 rsync
Viewed 3257 times since Wed, Oct 31, 2018