Open
Opened by Alessandro Selli @Alessandro

Jessie: logrotate causes rsyslog to use old logfile 

Description:    Devuan GNU/Linux 1.0 (jessie)
Release:        1.0
Codename:       jessie
ii  logrotate      3.8.7-1+b1   amd64        Log rotation utility
ii  rsyslog        8.4.2-1+deb8 amd64        reliable system and kernel loggin

After log file rotation rsyslogd uses old, rotated logfiles instead of new, empty logfiles. 

[root@wkstn04 ~]# fuser -va /var/log/{daemon,kern,auth,user,debug,messages}*
                     USER        PID ACCESS COMMAND
/var/log/mail*:
/var/log/daemon.log:
/var/log/daemon.log.1:                     root       1754 F.... rsyslogd
/var/log/daemon.log.2.gz:
/var/log/daemon.log.3.gz:
/var/log/daemon.log.4.gz:
/var/log/kern.log:
/var/log/kern.log.1:                       root       1754 F.... rsyslogd
/var/log/kern.log.2.gz:
/var/log/kern.log.3.gz:
/var/log/kern.log.4.gz:
/var/log/auth.log:
/var/log/auth.log.1:                       root       1754 F.... rsyslogd
/var/log/auth.log.2.gz:
/var/log/auth.log.3.gz:
/var/log/auth.log.4.gz:
/var/log/user.log:
/var/log/user.log.1:                       root       1754 F.... rsyslogd
/var/log/user.log.2.gz:
/var/log/user.log.3.gz:
/var/log/user.log.4.gz:
/var/log/lpr*:
/var/log/cron*:
/var/log/debug:
/var/log/debug.1:                          root       1754 F.... rsyslogd
/var/log/debug.2.gz:
/var/log/debug.3.gz:
/var/log/debug.4.gz:
/var/log/messages:
/var/log/messages.1:                       root       1754 F.... rsyslogd
/var/log/messages.2.gz:
/var/log/messages.3.gz:
/var/log/messages.4.gz:
[root@@wkstn04 ~]#

Problem was fixed configuring logrotate to copy-and-then-truncate log files instead of moving old log files: 

[root@wkstn04 ~]# diff -u /etc/logrotate.d/rsyslog{,.orig}
--- /etc/logrotate.d/rsyslog    2016-12-12 13:04:42.440465896 +0100
+++ /etc/logrotate.d/rsyslog.orig        2016-12-14 11:06:05.096908872 +0100
@@ -6,7 +6,6 @@
        notifempty
        delaycompress
 #      compress
-       copytruncate
        postrotate
                invoke-rc.d rsyslog rotate > /dev/null
        endscript
@@ -30,7 +29,6 @@
        missingok
        notifempty
 #      compress
-       copytruncate
        delaycompress
        sharedscripts
        postrotate
[root@wkstn04 ~]#

This is not the ideal fix however, as there is a small possibility that log messages are lost in the time the copy process completes and the log file is truncated.