[rsyslog-notify] Forum Thread: Wrong PID Filename on CentOS 7.2 Causes Logrotate Issue - (Mode 'post')
noreply at adiscon.com
noreply at adiscon.com
Thu Jul 7 23:31:34 CEST 2016
User: shane.lawrence
Forumlink: http://kb.monitorware.com/viewtopic.php?p=26724#p26724
Message:
----------
I noticed a strange issue with rsyslog:
[code:3qousnlp][root at aaabbbccc123 logrotate.d]# date
Thu Jul 7 20:03:24 UTC 2016
[root at aaabbbccc123 logrotate.d]# find /var/log/ -mmin -10
/var/log/secure-20160613
/var/log/messages-20160613
/var/log/rsyslog-stats.log
/var/log/lastlog
/var/log/audit/audit.log
/var/log/cron-20160613[/code:3qousnlp]
Rsyslog is writing to old, already-rotated log files (secure-20160613,
cron-20160613, messages-20160613) instead of the new files (secure, cron,
messages).
When I check the logrotate config, I find this:
[code:3qousnlp][root at aaabbbccc123 logrotate.d]# cat
/etc/logrotate.d/syslog
/var/log/cron
/var/log/maillog
/var/log/messages
/var/log/secure
/var/log/spooler
{
sharedscripts
postrotate
/bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2>
/dev/null || true
endscript
}[/code:3qousnlp]
The actual name of the rsyslog pid file is:
[code:3qousnlp][root at aaabbbccc123 logrotate.d]# ls
/var/run/*syslog*
/var/run/rsyslogd.pid[/code:3qousnlp]
Rsyslog’s init script is configured to use “syslogd.pid”:
[code:3qousnlp][root at aaabbbccc123 etc]# grep pid
/etc/init.d/rsyslog
PIDFILE=/var/run/syslogd.pid
daemon --pidfile="${PIDFILE}" $exec -i "${PIDFILE}"
$SYSLOGD_OPTIONS[/code:3qousnlp]
The issue is on CentOS 7.2.1511 using rsyslog 8.19.0.
Does anyone know how to make it use the correct pid filename?
More information about the rsyslog-notify
mailing list