Fedora 22 - syslog rotating but new old files being updated!

[Philip Rhoades]

Ed,

Thanks!

P.


> Date: Fri, 26 Jun 2015 17:28:40 +0800
> From: Ed Greshko <ed.greshko at greshko.com>
> To: users at lists.fedoraproject.org
> Subject: Re: Fedora 22 - syslog rotating but new old files being
> 	updated!
> Message-ID: <558D1B48.4070407 at greshko.com>
> Content-Type: text/plain; charset=utf-8
> 
> On 06/26/15 13:32, Philip Rhoades wrote:
>> People,
>> 
>> After I move from F21 to F22 (fresh install) and changing the 
>> frequency of logrotates to "daily", I notice that the new syslog logs 
>> (ie those without the date appended) are not being changed and the 
>> files from the date of the last reboot are the ones that continue to 
>> be updated! eg:
>> 
>> eg:
>> 
>> -rw-r--r--  1 root root       0 Jun 26 03:33 /var/log/cron
>> -rw-r--r--. 1 root root   35220 May 16 18:01 /var/log/cron-20150514
>> -rw-r--r--. 1 root root    6006 Jun 17 18:10 /var/log/cron-20150617
>> -rw-r--r--  1 root root  275974 Jun 21 03:47 /var/log/cron-20150621
>> -rw-r--r--  1 root root  725768 Jun 26 15:31 /var/log/cron-20150624
>> -rw-r--r--  1 root root       0 Jun 24 03:15 /var/log/cron-20150625
>> -rw-r--r--  1 root root       0 Jun 25 03:27 /var/log/cron-20150626
>> -rw-------  1 root root       0 Jun 26 03:33 /var/log/maillog
>> -rw-------. 1 root root       0 Apr 16 09:15 /var/log/maillog-20150514
>> -rw-------. 1 root root       0 May 14 14:45 /var/log/maillog-20150617
>> -rw-------  1 root root  605403 Jun 21 03:34 /var/log/maillog-20150621
>> -rw-------  1 root root 1844346 Jun 26 15:31 /var/log/maillog-20150624
>> -rw-------  1 root root       0 Jun 24 03:15 /var/log/maillog-20150625
>> -rw-------  1 root root       0 Jun 25 03:27 /var/log/maillog-20150626
>> -rw-------  1 root root  553261 Jun 21 01:31 /var/log/maillog.t
>> -rw-------  1 root root       0 Jun 26 03:33 /var/log/messages
>> -rw-------. 1 root root 2060072 May 16 18:02 
>> /var/log/messages-20150514
>> -rw-------. 1 root root 1830620 Jun 17 18:13 
>> /var/log/messages-20150617
>> -rw-------  1 root root 4738203 Jun 21 03:47 
>> /var/log/messages-20150621
>> -rw-------  1 root root 3275905 Jun 26 15:30 
>> /var/log/messages-20150624
>> -rw-------  1 root root       0 Jun 24 03:15 
>> /var/log/messages-20150625
>> -rw-------  1 root root       0 Jun 25 03:27 
>> /var/log/messages-20150626
>> -rw-------  1 root root       0 Jun 26 03:33 /var/log/secure
>> -rw-------. 1 root root   16180 May 16 18:01 /var/log/secure-20150514
>> -rw-------. 1 root root    8410 Jun 17 18:13 /var/log/secure-20150617
>> -rw-------  1 root root  127116 Jun 21 03:47 /var/log/secure-20150621
>> -rw-------  1 root root  118816 Jun 26 00:14 /var/log/secure-20150624
>> -rw-------  1 root root       0 Jun 24 03:15 /var/log/secure-20150625
>> -rw-------  1 root root       0 Jun 25 03:27 /var/log/secure-20150626
>> -rw-------  1 root root       0 Jun 26 03:33 /var/log/spooler
>> -rw-------. 1 root root       0 Apr 16 09:15 /var/log/spooler-20150514
>> -rw-------. 1 root root       0 May 14 14:45 /var/log/spooler-20150617
>> -rw-------  1 root root       0 Jun 17 18:10 /var/log/spooler-20150621
>> -rw-------  1 root root       0 Jun 21 03:44 /var/log/spooler-20150624
>> -rw-------  1 root root       0 Jun 24 03:15 /var/log/spooler-20150625
>> -rw-------  1 root root       0 Jun 25 03:27 /var/log/spooler-20150626
>> 
>> Any suggestions about why this is happening?
>> 
>> 
> 
> Just asked/answered earlier today....   I'll repeat....
> 
> This is due to the known bug in the logrotate file for rsyslog/syslog.
> 
> Edit /etc/logrotate.d/syslog and make sure the postrotate line has
> "rsyslogd.pid" and not "syslogd.pid"
> 
> You can either allow things to sort themselves out, or running the
> "kill" command as shown will fix it.
> 
> The only caveat is that the permissions on the new files will be
> rw-r--r-- due to the umask.  You can fix that manually if you wish.


-- 
Philip Rhoades

PO Box 896
Cowra  NSW  2794
Australia
E-mail:  phil at pricom.com.au