F22 rsyslogd writes to a dated file name...

[Ed Greshko]

On 06/26/15 09:49, dwoody5654 wrote:
> The following is a current list of the messages file in /var/log:
>
> -rw-------. 1 root root 104339300 Jun 20 10:27 messages-20150614
> -rw-------  1 root root                 0 Jun 22 03:30 messages
> -rw-------  1 root root  36077670 Jun 25 20:25 messages-20150622
>
> The other log files are treated similarly.
>
> -rw-------. 1 root root 9446999 Jun 20 10:27 secure-20150614
> -rw-------  1 root root             0 Jun 22 03:30 secure
> -rw-------  1 root root 1493733 Jun 25 20:38 secure-20150622
>
> I have bot been able to find out why the messages file is zero length or why the messages file that is being written to is a date identified file, in this case messages-20150622.
>
> Is there a config setting to change this? 

This is most likely due to the known bug in the logrotate file for rsyslog/syslog. 

Edit /etc/logrotate.d/syslog and make sure the postrotate line has "rsyslogd.pid" and not "syslogd.pid"

You can either allow things to sort themselves out, or running the "kill" command as shown will probably fix it.