Syslog and/or logrotate problem

[Brad Crotchett]

>You're missing a command to cause your process to re-open it's log-file.
>Typically something like sending it a -HUP or doing a service <whatever>
>restart.

>What's happening is the logrotate script is properly moving the file
>(log -> log.1 -> log.2), but your server process is not re-opening the
>file.  Since the log file is just moved, the existing file-handle used
>to write the file is still valid, so your server process happily
>continues to write data to the newly re-named log file.

>Take a look at some of the RedHat examples in /etc/logrotate.d, and
>check out the logrotate man pages.  You probably want to make a
>postrotate script that causes your server to re-open it's log files.
>For instance, the apache logrotate entry sends a -HUP:

>[root at iguana root]# cat /etc/logrotate.d/apache
>/var/log/httpd/access_log /var/log/httpd/agent_log
>/var/log/httpd/error_log /var/log/httpd/referer_log {
>    daily
>    mail webmaster at newtek.com
>    compress
>    delaycompress
>    missingok
>    sharedscripts
>    postrotate
>        /bin/kill -HUP `cat /var/run/httpd.pid 2>/dev/null` 2> /dev/null
>|| true
>    endscript
>}

>Modify as required for your mail server...

>Charles Steinkuehler
>charles at steinkuehler.net

Ok, and that looks exactly like my /etc/logrotate.d/apache file.  There is
not file in there about mail, nor is there on the server that is properly
rotating the mail logs.  The mail log rotation is in
/etc/logrotate.d/syslog, and again the setups are identical.  Here are
samples of my config files and scripts on the failing server:

[root at ray logrotate.d]# cat /etc/logrotate.conf
# see "man logrotate" for details
# rotate log files weekly
daily

# keep 4 weeks worth of backlogs
rotate 4

# create new (empty) log files after rotating old ones
create

# uncomment this if you want your log files compressed
#compress

# RPM packages drop log rotation information into this directory
include /etc/logrotate.d

# no packages own lastlog or wtmp -- we'll rotate them here
/var/log/wtmp {
    weekly
    create 0664 root utmp
    rotate 1
}

# system-specific logs may be also be configured here.

[root at ray logrotate.d]# cat syslog
/var/log/messages /var/log/secure /var/log/maillog /var/log/spooler
/var/log/boot.log /var/log/cron {
    sharedscripts
    postrotate
        /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null
|| true
    endscript
}

Thanks again!

Brad