Fedora 22 - syslog rotating but new old files being updated!

[Ed Greshko]

On 06/26/15 13:32, Philip Rhoades wrote:
> People,
>
> After I move from F21 to F22 (fresh install) and changing the frequency of logrotates to "daily", I notice that the new syslog logs (ie those without the date appended) are not being changed and the files from the date of the last reboot are the ones that continue to be updated! eg:
>
> eg:
>
> -rw-r--r--  1 root root       0 Jun 26 03:33 /var/log/cron
> -rw-r--r--. 1 root root   35220 May 16 18:01 /var/log/cron-20150514
> -rw-r--r--. 1 root root    6006 Jun 17 18:10 /var/log/cron-20150617
> -rw-r--r--  1 root root  275974 Jun 21 03:47 /var/log/cron-20150621
> -rw-r--r--  1 root root  725768 Jun 26 15:31 /var/log/cron-20150624
> -rw-r--r--  1 root root       0 Jun 24 03:15 /var/log/cron-20150625
> -rw-r--r--  1 root root       0 Jun 25 03:27 /var/log/cron-20150626
> -rw-------  1 root root       0 Jun 26 03:33 /var/log/maillog
> -rw-------. 1 root root       0 Apr 16 09:15 /var/log/maillog-20150514
> -rw-------. 1 root root       0 May 14 14:45 /var/log/maillog-20150617
> -rw-------  1 root root  605403 Jun 21 03:34 /var/log/maillog-20150621
> -rw-------  1 root root 1844346 Jun 26 15:31 /var/log/maillog-20150624
> -rw-------  1 root root       0 Jun 24 03:15 /var/log/maillog-20150625
> -rw-------  1 root root       0 Jun 25 03:27 /var/log/maillog-20150626
> -rw-------  1 root root  553261 Jun 21 01:31 /var/log/maillog.t
> -rw-------  1 root root       0 Jun 26 03:33 /var/log/messages
> -rw-------. 1 root root 2060072 May 16 18:02 /var/log/messages-20150514
> -rw-------. 1 root root 1830620 Jun 17 18:13 /var/log/messages-20150617
> -rw-------  1 root root 4738203 Jun 21 03:47 /var/log/messages-20150621
> -rw-------  1 root root 3275905 Jun 26 15:30 /var/log/messages-20150624
> -rw-------  1 root root       0 Jun 24 03:15 /var/log/messages-20150625
> -rw-------  1 root root       0 Jun 25 03:27 /var/log/messages-20150626
> -rw-------  1 root root       0 Jun 26 03:33 /var/log/secure
> -rw-------. 1 root root   16180 May 16 18:01 /var/log/secure-20150514
> -rw-------. 1 root root    8410 Jun 17 18:13 /var/log/secure-20150617
> -rw-------  1 root root  127116 Jun 21 03:47 /var/log/secure-20150621
> -rw-------  1 root root  118816 Jun 26 00:14 /var/log/secure-20150624
> -rw-------  1 root root       0 Jun 24 03:15 /var/log/secure-20150625
> -rw-------  1 root root       0 Jun 25 03:27 /var/log/secure-20150626
> -rw-------  1 root root       0 Jun 26 03:33 /var/log/spooler
> -rw-------. 1 root root       0 Apr 16 09:15 /var/log/spooler-20150514
> -rw-------. 1 root root       0 May 14 14:45 /var/log/spooler-20150617
> -rw-------  1 root root       0 Jun 17 18:10 /var/log/spooler-20150621
> -rw-------  1 root root       0 Jun 21 03:44 /var/log/spooler-20150624
> -rw-------  1 root root       0 Jun 24 03:15 /var/log/spooler-20150625
> -rw-------  1 root root       0 Jun 25 03:27 /var/log/spooler-20150626
>
> Any suggestions about why this is happening?
>
>

Just asked/answered earlier today....   I'll repeat....

This is due to the known bug in the logrotate file for rsyslog/syslog. 

Edit /etc/logrotate.d/syslog and make sure the postrotate line has "rsyslogd.pid" and not "syslogd.pid"

You can either allow things to sort themselves out, or running the "kill" command as shown will fix it.

The only caveat is that the permissions on the new files will be rw-r--r-- due to the umask.  You can fix that manually if you wish.




-- 
Sorta what I want to say when folks habitually complain about Fedora - https://youtu.be/ZArl8fTfub4