[pve-devel] BIG PROBLEM - Possible Bug - Log-Rotation

[Daniel Hunsaker]

Send a SIGHUP to syslogd.  That should fix the rotation.  The issue is that
the syslogd is writing to an inode, not a filename (it still has the handle
open when logrotate renames the file, so it keeps writing to it until told
not to via SIGHUP.

killall -HUP syslogd

Best guess is the SIGHUP was never received by syslogd on one of
logrotate's passes.  Probably changed PIDs due to a restart of some kind
after logrotate had started, but before it finished.  You can configure
logrotate to copy/truncate instead of move/SIGHUP to prevent this in
future, but you risk losing any entries logged between the copy and the
truncate.  So it's up to you which is more important - getting every log
entry (which you are now, at risk of rotation breaking down) or keeping
rotation stable (at the cost of maybe losing a few log entries in the few
milliseconds between copy and truncate).

On Wed, Dec 10, 2014, 18:06 Detlef Bracker <bracker at 1awww.com> wrote:

>  Dear,
>
> I have the same problem on 2 diferent hosts! The logrotate is not working
> correct and the logs
> are not going in the log-files normal, they go in the log-file with the
> number .1 !!!
> Expample not logged in auth - but logged in auth.1
> or not logged in syslog - but logged in syslog.1
>
> *This is a security risk*, when you check with fail2ban the hosts-files
> about hackings via console,
> ssh and some-thing on! - and I dont know, that I have this only or others
> too!
>
> uname -a
>
> Linux pm3-host 2.6.32-31-pve #1 SMP Thu Jul 24 06:44:16 CEST 2014 x86_64
> GNU/Linux
>
> The logrotate job in cron.daily not working, but I get not an error! The
> logrotate stop at the
> 23 octobre on 1 host and on the other at the 30. september!
>
> Have somebody a resolution w/o a reboot?
>
> Dear
>
> Detlef
>  _______________________________________________
> pve-devel mailing list
> pve-devel at pve.proxmox.com
> http://pve.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.proxmox.com/pipermail/pve-devel/attachments/20141211/8578f29a/attachment.htm>