It doesn't rotate, it just delete data I fear : #n22 ~ # ls -l /var/log/messages* -rw------- 1 root root 220 Apr 15 20:41 /var/log/messages -rw------- 1 root root 45833 Mar 24 16:10 /var/log/messages-20130324.gz -rw------- 1 root root 24776 Apr 1 16:30 /var/log/messages-20130401.gz -rw------- 1 root root 42398 Apr 7 10:30 /var/log/messages-20130407.gz -rw------- 1 root root 11938 Apr 14 10:00 /var/log/messages-20130414.gz n22 ~ # /usr/sbin/logrotate -f /etc/logrotate.d/syslog-ng n22 ~ # ls -l /var/log/messages* -rw------- 1 root root 115 Apr 15 20:42 /var/log/messages -rw------- 1 root root 45833 Mar 24 16:10 /var/log/messages-20130324.gz -rw------- 1 root root 24776 Apr 1 16:30 /var/log/messages-20130401.gz -rw------- 1 root root 42398 Apr 7 10:30 /var/log/messages-20130407.gz -rw------- 1 root root 11938 Apr 14 10:00 /var/log/messages-20130414.gz n22 ~ # emerge --info syslog-ng Portage 2.1.11.55 (default/linux/x86/13.0/desktop/kde, gcc-4.6.3, glibc-2.15-r3, 3.8.7 i686) ================================================================= System Settings ================================================================= System uname: Linux-3.8.7-i686-Intel-R-_Core-TM-_i5-2540M_CPU_@_2.60GHz-with-gentoo-2.1 KiB Mem: 8174404 total, 1524424 free KiB Swap: 9767516 total, 9767516 free Timestamp of tree: Mon, 15 Apr 2013 15:45:01 +0000 ld GNU ld (GNU Binutils) 2.22 ccache version 3.1.9 [disabled] app-shells/bash: 4.2_p37 dev-java/java-config: 2.1.12-r1 dev-lang/python: 2.7.3-r3, 3.2.3-r2 dev-util/ccache: 3.1.9 dev-util/cmake: 2.8.9 dev-util/pkgconfig: 0.28 sys-apps/baselayout: 2.1-r1 sys-apps/openrc: 0.11.8 sys-apps/sandbox: 2.6-r1 sys-devel/autoconf: 2.13, 2.69 sys-devel/automake: 1.9.6-r3, 1.11.6, 1.12.6 sys-devel/binutils: 2.22-r1 sys-devel/gcc: 4.6.3 sys-devel/gcc-config: 1.7.3 sys-devel/libtool: 2.4-r1 sys-devel/make: 3.82-r4 sys-kernel/linux-headers: 3.7 (virtual/os-headers) sys-libs/glibc: 2.15-r3 Repositories: gentoo toralf ACCEPT_KEYWORDS="x86" ACCEPT_LICENSE="*" CBUILD="i686-pc-linux-gnu" CFLAGS="-O2 -march=native -pipe" CHOST="i686-pc-linux-gnu" CONFIG_PROTECT="/etc /usr/share/config /usr/share/gnupg/qualified.txt /usr/share/polkit-1/actions" CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/php/apache2-php5.4/ext-active/ /etc/php/cgi-php5.4/ext-active/ /etc/php/cli-php5.4/ext-active/ /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo" CXXFLAGS="-O2 -march=native -pipe" DISTDIR="/usr/portage/distfiles" EMERGE_DEFAULT_OPTS="--autounmask=n --keep-going=y --nospinner --tree --quiet-build --deep" FCFLAGS="-O2 -march=i686 -pipe" FEATURES="assume-digests binpkg-logs compress-build-logs config-protect-if-modified distlocks ebuild-locks fixlafiles merge-sync news parallel-fetch protect-owned sandbox sfperms strict test test-fail-continue unknown-features-warn unmerge-logs unmerge-orphans userfetch" FFLAGS="-O2 -march=i686 -pipe" GENTOO_MIRRORS="http://mirror.netcologne.de/gentoo/ http://ftp.snt.utwente.nl/pub/os/linux/gentoo http://gentoo.mirror.dkm.cz/pub/gentoo/ http://mirror.bytemark.co.uk/gentoo/" LANG="en_US.utf8" LDFLAGS="-Wl,-O1 -Wl,--as-needed" MAKEOPTS="-j4" PKGDIR="/usr/portage/packages" PORTAGE_CONFIGROOT="/" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages" PORTAGE_TMPDIR="/var/tmp" PORTDIR="/usr/portage" PORTDIR_OVERLAY="/usr/local/portage" SYNC="rsync://rsync.de.gentoo.org/gentoo-portage" USE="X a52 aac acl acpi alsa apache2 berkdb bittorrent branding bzip2 cairo cdda cdr classic cli consolekit corefonts cracklib crypt css cups cxx dbus declarative dri dts dvb dvd dvdr emboss encode exif fam fastbuild ffmpeg firefox flac fontconfig fortran g3dvl gdbm gif git gmp gphoto2 gpm gtk hyphenation iconv ipv6 java jpeg kde kipi kqemu kvm lcms ldap libnotify logrotate mad mbox mmx mng modules mp3 mp4 mpeg mudflap mysql mysqli ncurses nls nptl nsplugin ntfs ogg opengl openmp pam pango pcre pdf phonon pkcs11 plasma png policykit ppds qemu qt3support qt4 rdesktop readline sdl session sna spell spice sse sse2 sse4_1 ssl ssse3 startup-notification svg tcpd thinkpad threads tiff tk transparent-proxy truetype udev udisks uml unicode upower usb uxa v4l vaapi vim-syntax vnc vorbis wxwidgets x264 x86 xa xcb xcomposite xinerama xml xpm xscreensaver xv xvid xvmc zlib" ABI_X86="32" ALSA_CARDS="hda-intel" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mmap_emul mulaw multi null plug rate route share shm softvol" APACHE2_MODULES="access actions alias auth_basic auth_digest authn_anon authn_core authn_dbd authn_dbm authn_default authn_file authz_core authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi dav dav_fs dav_lock dbd deflate dir disk_cache env expires ext_filter file_cache filter headers ident imagemap include info log_config logio mem_cache mime mime_magic negotiation proxy proxy_ajp proxy_balancer proxy_connect proxy_http rewrite setenvif so socache_shmcb speling status unique_id unixd userdir usertrack vhost_alias" CALLIGRA_FEATURES="kexi words flow plan sheets stage tables krita karbon braindump" CAMERAS="ptp2" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf superstar2 timing tsip tripmate tnt ubx" INPUT_DEVICES="evdev synaptics" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LIBREOFFICE_EXTENSIONS="presenter-console presenter-minimizer" LINGUAS="en en_GB" LIRC_DEVICES="devinput" OFFICE_IMPLEMENTATION="libreoffice" PHP_TARGETS="php5-4" PYTHON_SINGLE_TARGET="python2_7" PYTHON_TARGETS="python2_7 python3_2" QEMU_SOFTMMU_TARGETS="i386 x86_64" QEMU_USER_TARGETS="i386 x86_64" RUBY_TARGETS="ruby19" USERLAND="GNU" VIDEO_CARDS="intel" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account" Unset: CPPFLAGS, CTARGET, INSTALL_MASK, LC_ALL, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS, USE_PYTHON ================================================================= Package Settings ================================================================= app-admin/syslog-ng-3.2.5 was built with the following: USE="(consolekit) ipv6 pcre (policykit) ssl tcpd test -caps -hardened (-selinux) -spoof-source -sql" n22 ~ # cat /etc/logrotate.d/syslog-ng # $Header: /var/cvsroot/gentoo-x86/app-admin/syslog-ng/files/syslog-ng.logrotate,v 1.3 2008/10/15 20:46:12 mr_bones_ Exp $ # # Syslog-ng logrotate snippet for Gentoo Linux # contributed by Michael Sterrett # /var/log/messages { missingok sharedscripts postrotate /etc/init.d/syslog-ng reload > /dev/null 2>&1 || true endscript }
The last rotation on /var/log/messages was apparently done on April 14, so it isn't done again on the 15th, probably because you have "weekly" in /etc/logrotate.conf. It shouldn't clear out the file, though. Can you post the changes between both /var/log/messages files (redacted if needed)?
(In reply to comment #1) > The last rotation on /var/log/messages was apparently done on April 14, so > it isn't done again on the 15th, probably because you have "weekly" in > /etc/logrotate.conf. yeah - looks like a logic flow in logrotate, I do currently have (Gentoo default): $ cat /etc/logrotate.d/syslog-ng # $Header: /var/cvsroot/gentoo-x86/app-admin/syslog-ng/files/syslog-ng.logrotate,v 1.3 2008/10/15 20:46:12 mr_bones_ Exp $ # # Syslog-ng logrotate snippet for Gentoo Linux # contributed by Michael Sterrett # /var/log/messages { missingok sharedscripts postrotate /etc/init.d/syslog-ng reload > /dev/null 2>&1 || true endscript } >It shouldn't clear out the file, though. yes >Can you post the changes between both /var/log/messages files (redacted if needed)? no - the old messages are just away :-(
this doesn't have anything to do with syslog-ng as far as I can tell.
(In reply to comment #3) > this doesn't have anything to do with syslog-ng as far as I can tell. correct re-assigning to app-admin/logrotate
I think this is what's happening: You are running logrotate with syslog-ng as its config file (not logrotate.conf), so no 'dateext' option is set (previous rotations took place with this option set), so there is no way for logrotate to identify previous rotations. According to the following snippet, no old logs are kept when forced from the command line, so your /var/log/messages file gets renamed and deleted, because its the disposed name in the rotation: <snip> # /usr/sbin/logrotate -fv /etc/logrotate.d/syslog-ng reading config file /etc/logrotate.d/syslog-ng Handling 1 logs rotating pattern: /var/log/messages forced from command line (no old logs will be kept) empty log files are rotated, old logs are removed considering log /var/log/messages log needs rotating rotating log /var/log/messages, log->rotateCount is 0 dateext suffix '-20130418' glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]' renaming /var/log/messages.1 to /var/log/messages.2 (rotatecount 1, logstart 1, i 1), old log /var/log/messages.1 does not exist renaming /var/log/messages.0 to /var/log/messages.1 (rotatecount 1, logstart 1, i 0), old log /var/log/messages.0 does not exist log /var/log/messages.2 doesn't exist -- won't try to dispose of it renaming /var/log/messages to /var/log/messages.1 disposeName will be /var/log/messages.1 running postrotate script removing old log /var/log/messages.1 </snip> I don't think we should consider this a bug, because the proper way to run logrotate in this case is: /usr/sbin/logrotate -f /etc/logrotate.conf
(In reply to comment #5) > I don't think we should consider this a bug, because the proper way to run > logrotate in this case is: > > /usr/sbin/logrotate -f /etc/logrotate.conf Hhm - ok. (But me is just wondering how to properly run logrotate for one specific log file)
(In reply to comment #6) > (But me is just wondering how to properly run logrotate for one specific log > file) Well, I think that depends a lot on your setup. You can change the line: include /etc/logrotate.d to: include /etc/logrotate.d/syslog-ng in the /etc/logrotate.conf config file This way only the syslog-ng config is sourced.
ok - thx So this bug report is marked by me as invalid.
