terraform-google-modules/terraform-google-vault

Typo in logrotate config?

raj-saxena opened this issue · 2 comments

I noticed in our installation that the audit and server logs stopped being written after the files were rotated. After going through the article about vault auditing and other threads like this, I believe that we need to indeed send SIGHUP to the vault process.
Looking at the startup script, I see that the authors of this module configure logrotate for vault.
However, I see 2 issues with the postrotate section:

...
  postrotate
    test -s run/rsyslogd.pid && kill -HUP $(cat /run/rsyslogd.pid)
    true
...
  1. The test would always fail as the correct filepath should be /run/rsyslogd.pid (missing leading forward-slash).
  2. I am not sure why we are sending the SIGHUP to the rsyslog process. Based on what the Vault page says, it should be the pid of Vault.

As a quick fix to my problem, I verified that the following restores logs being written to /var/log/{audit, server}.log

$ vault audit-disable file
$ vault audit-enable file path=...

Added a PR with a possible fix based on my observations on the vault instance.
Screenshot 2020-02-12 at 13 49 05

I request you to please explain if I am wrong in my understanding. Thanks