[clue-admin] Logrotate is b0rked

[Jed S. Baer]

On Sun, 27 Mar 2005 14:48:04 -0700
David Anselmi wrote:

> The lines for kill -HUP <PID of syslogd> will put this kind of line in:
> 
> syslogd 1.4.1#16: restart (remote reception)

The only syslogd restarts I find are the ones I can attribute to my own
test/fix commands.

> If you don't see that it means the kill -HUP isn't running, which 
> explains the problem.  Could be that logrotate is failing before the 
> kill.  Did you run it by hand?  See:
> 
> http://info.ccone.at/INFO/Mail-Archives/redhat/Jul-2004/msg00457.html

Yeah, I ran it by hand last time I was messing with this.

  logrotate -f /etc/logrotate.d/syslog

And got an error that didn't give any clue what I should look for. So, I
do it again.

$ sudo /usr/sbin/logrotate -f /etc/logrotate.d/syslog 
error: error running shared postrotate script for /var/log/messages
/var/log/secure /var/log/maillog /var/log/spooler /var/log/boot.log
/var/log/cron 

What's really interesting is that before running this, I renamed the ".1"
files back to their normal names, and after forcing logrotate, they got
deleted. Since I had rotated logs yesterday, we lost less than 24hrs of
log data.

So all I know is that it can't send a HUP to syslogd. Why? Beats me.

We don't have any problems with missing files where a missingok would fix
the problem, and no attempts that I can see to create files based on
non-existent users/groups. Honestly, if that were the problem, I'd expect
something more informative in the logs. (But I've been incorrect in that
expectation many times.)

jed
-- 
http://s88369986.onlinehome.us/freedomsight/
Key fingerprint = B027 FEFB 4281 CC72 67D1  4237 F2D0 D356 077A A30E
... it is poor civic hygiene to install technologies that could someday
facilitate a police state. -- Bruce Schneier