rsyslog not rotating at fixed file size

Question

I am trying to create a separate log file for a application in Linux. So far I have created a .conf script to separate log in custom log file based on program name and it's working correctly.

But, I want to limit the size of log file at 10K and I am using $outchannel for this purpose. The script is stored as /etc/rsyslog.d/00-abc_log.conf:

$outchannel o_abc, /var/log/abc.log, 10240, /home/xyz/logrot
if $programname == 'abc' then :omfile:$o_abc

and script /home/xyz/logrot contains the following:

mv -f /var/log/abc.log /var/log/abc.log.1

Below the 10K limit the logging is working correctly, but after log exceeds 10K size limit, file abc.log.1 doesn't generated and logging in abc.log stops.

If it matters, my system is Xubuntu 12.04 running rsyslog-5.8.6.

Thanks in advance.

Solution

Your problem occurs because the application still has the file descriptor open after you moved it on the filesystem. Unless you can tell the program to restart logging directly after moving (usually for deamons, there's a signal for it like SIGHUP), you will have to use another method for rotation than moving files around to which are written into at that time

I suggest to use logrotate like the following. Haven't tested it, as you haven't shared the application involved.

Create your own logrotate configuration file, e.g. abclogrotate.conf:

/var/log/abc.log {
    # don't use time based rotation, but size-based
    size 10k
    # don't move, but copy-and-truncate so the application won't have to be
    # told that the file has moved.
    copytruncate
    # maximum of one old file
    rotate 1
    # counting old files starts at 1 rather than 0
    start 1
    # don't use compression
    nocompress
}

Now call logrotate like this: logrotate /path/to/abclogrotate.conf rather than your own script.

Comments

[Admin]

Please do not crosspost serverfault.com/questions/458681/…

[Admin]

Logrotate runs on demand too. Just don't put a config file in /etc/logrotate.d/ but specify a path yourself to your own config file. Anyway, I suspect your original problem occurs because your application still has a file descriptor open to the other file. Just use Logrotate with its copytruncate option to not move the file, but rather copy-and-truncate it.

[fencekicker]

I know the question and answer are 10 years old, but just in case somebody actually tries this, note a few caveats: 1) recent versions of rsyslogd (I played with 8.2001.0 from Ubuntu 20.04) run as the syslog user, while logrotate likes to run as root. You'll probably need a custom logrotate configuration file with an appropriate 'su syslog' or similar directive, and you might need to use a different status file and 2) outchannels in rsyslog don't support commands with more than 1 parameter; if calling logrotate <conf_file>, that's fine, but you'll probably need more, so use a wrapper script