instantlinux/docker-tools

[rsyslogd] [logrotate] proper way to reload `rsyslog` after doing logrotation

pjacak opened this issue · 2 comments

In logrotate examples of how to handle rsyslog's logs it's suggested to have lines like that et the end of config:

  postrotate
    reload rsyslog >/dev/null 2>&1 || true
  endscript

In this image there is no openRC, no services instead rsyslogd is just started in entrypoint.sh. So this command fails:

/ # reload rsyslog
sh: reload: not found

and as a result after logs rotation new file is not written.

Solution I've found working was to use this in logrotate config

  postrotate
    pkill -HUP rsyslogd || true
  endscript

to reload rsyslogd.

It's not exactly problem with this image, but I think a note about it in README.md might help others.

This is what I have provided in the helm chart for file /etc/logrotate.d/syslog (as a configmap):

# This file created from k8s configmap
# the mail log files are used by all syslog daemons
# the news log files are used by all syslog daemons
/var/log/warn /var/log/messages /var/log/allmessages /var/log/localmessages
/var/log/mail /var/log/mail.info /var/log/mail.warn /var/log/mail.err
/var/log/news/news.crit /var/log/news/news.err /var/log/news/news.notice
/var/log/cron /var/log/secure
{
    compress
    dateext
    maxage 365
    rotate 45
    missingok
    notifempty
    size +4096k
    create 640 root root
    sharedscripts
    postrotate
        /usr/bin/killall -HUP rsyslogd
    endscript
}

The alpine distro provides this prior to the kubernetes override:

/var/log/messages
/var/log/auth.log
/var/log/cron.log
/var/log/kern.log
/var/log/mail.log
{
	notifempty
	compress
	sharedscripts
	postrotate
		/etc/init.d/rsyslog --ifstarted reload >/dev/null
	endscript
}

Next time I update this image, I'll copy the helm template's version of the file into this image.

I added this file, in PR #130, to override and fix the erroneous alpine package:

/var/log/messages
/var/log/auth.log
/var/log/cron.log
/var/log/kern.log
/var/log/mail.log
{
    compress
    dateext
    maxage 365
    rotate 45
    missingok
    notifempty
    size +4096k
    create 640 root root
    sharedscripts
    postrotate
        /usr/bin/killall -HUP rsyslogd
    endscript
}

It's in the 8.2306.0-r2 tag of instantlinux/rsyslogd image.