Purpose of "postrotate invoke-rc.d rsyslog rotate" when logrotating, and is this command outdated?

Question

When using logrotate to keep log files rotating, I have seen

postrotate
                invoke-rc.d rsyslog rotate > /dev/null
endscript

I know postrotate makes bash execute the following command after the log file is rotated, but what is the purpose of this command being executed exactly?

Finally, is it now outdated? (I seem to seeing a message from anacron saying "The script you are attempting to invoke has been converted to an Upstart job, but rotate is not supported for Upstart jobs.")

Solution 1

The purpose of the command is forcing rsyslog to reopen the files it's using to write logs. It's used after logrotate moves the old files, so rsyslog starts writing to the new ones.

Example: rsyslog writes most of its stuff to /var/log/syslog. When logrotate kicks in, it moves this file to /var/log/syslog.1 and creates a new, empty /var/log/syslog. But as you probably know (but just in case), rsyslog is not writing to a file named /var/log/syslog, but to a file descriptor it got the first time it opened the file. You can move around the file associated and rsyslog would keep writing to it, because it only knows about the file descriptor. When you move /var/log/syslog to /var/log/syslog.1, rsyslog will keep writing to /var/log/syslog.1, because that's what its file descriptor points to. In fact, you could even delete the file and rsyslog would keep writing. That's what happens when files that are deleted seem to be occupying space: the file descriptors are still opened, and thus the space is not freed. This only happens when the last reference to the file is closed.

The "rotate" argument is meant to force the release of old file descriptors, and to tell rsyslog that it must open the files again, so it gets new file descriptors to the new files and the old ones can be properly disposed of.

As to it being outdated, I'm afraid I don't know. That's what took me to your question O:-) But I believe the problem is that the upstart config is not ready to accept this option. I've replaced it with this, from the man page:

kill -HUP $(cat /var/run/rsyslogd.pid)

Which is what "rotate" did, anyway. Hope that helps.

Solution 2

I had a similar issue, and it seems like the rsyslog configuration for logrotate is broken, so instead of calling service rsyslog rotate which actually works, it uses reload rsyslog or similar. Turns out this was actually a bug, which has been fixed in version 7.4.4-1ubuntu5, but my installation of Ubuntu 14.04 only sees version 7.4.4-1ubuntu2 in apt.

This is the fix that worked for me:

Edit the file /etc/logrotate.d/rsyslog, replacing the line inside the postrotate block (e.g. reload rsyslog or invoke-rc.d rsyslog rotate) with this:

service rsyslog rotate >/dev/null 2>&1 || true

This is what the block should look like:

postrotate
    service rsyslog rotate >/dev/null 2>&1 || true
endscript

With all the surrounding lines kept as they are.

As a last step, it might be a good idea to run the command manually once:

service rsyslog rotate