4

Every time after newsyslog rotates the log file, syslog stops logging into the file. Until a syslogd restart is done. 

(myserver:wheel)# logger -p local1.info -t myprocess "hello thiru"; ll myfile.log; cat myfile.log
-rw-r--r--  1 root  wheel     0B Nov 10 11:26 myfile.log

(myserver:wheel)# /etc/rc.d/syslogd restart
Stopping syslogd.
Starting syslogd.

(myserver:wheel)# logger -p local1.info -t myprocess "hello thiru"; ll myfile.log; cat myfile.log
-rw-r--r--  1 root  wheel    44B Nov 10 12:04 myfile.log
Nov 10 12:04:31 myserver myprocess: hello thiru 
(myserver:wheel)#

On Linux (which uses logrotate), we can solve this by doing syslog/rsyslog restart in the postrotate section of the logroate conf.

Is there something similar to postrotate in newsyslog?

Edit:

Syslog and newsyslog conf files:

(TPC-E11-36:wheel)# cat /etc/newsyslog.d/newsyslog-myprocess.conf
/var/log/myfile.log 644 20 10000 * Z

(TPC-E11-36:wheel)# cat /etc/syslog.d/syslog-myprocess.conf
!myprocess
local1.info /var/log/myfile.log
(TPC-E11-36:wheel)#
Thirupathi Thangavel
  • 2,418
  • 3
  • 29
  • 49
  • 2
    See `man newsyslog.conf`, but by default `syslogd` receives a signal when a log file is rotated unless either an `N` flag or **another process** has been specified. Check your `newsyslog.conf` or `newsyslog.conf.d/*` files. – Richard Smith Nov 11 '16 at 09:30
  • @RichardSmith I don't know how to specify a process in `newsyslog.conf`? And I haven't used `N` flag either. – Thirupathi Thangavel Nov 18 '16 at 14:56
  • 1
    I cannot replicate the problem. If I add your lines to my `/etc/syslog.conf` and invoke `newsyslog -f newsyslog-cnd.conf`, the logfile is rotated, a new one is created with a message `logfile turned over due to size` and `logger` works fine into the new file. I do not recognise your subdirectories `newsyslog.d` and `syslog.d` and I do not get a `0B` file after log rotation. – Richard Smith Nov 18 '16 at 15:47
  • @RichardSmith I too can't replicate it now :( Is it possible that this happened because of Daylight Saving Time change? And please ignore the sub directories. My syslog.conf and newsyslog.conf include them. – Thirupathi Thangavel Nov 25 '16 at 12:18

2 Answers2

1

Add the path of the pidfile into the /etc/newsyslog.conf and if required a signal for example 1 that stands for SIGHUP, more info about newsyslog here: https://www.freebsd.org/doc/handbook/configtuning-syslog.html

The format/example is this:

# logfilename          [owner:group]    mode count size when  flags [/pid_file] [sig_num]

/var/log/your-app.log   root:wheel      600  7     *    @T00  GBJC  /var/run/your-app.pid 1

Also see this answer: https://serverfault.com/a/701563/94862

Community
  • 1
  • 1
nbari
  • 25,603
  • 10
  • 76
  • 131
1

There is actually something similar to postrotate in newsyslog, it's the R flag in the configuration file in combination with path_to_pid_cmd_file (that's what it's called in the FreeBSD manual entry of newslog.conf(5)). With this flag set, the path provided will not be interpreted as a path to a PID file, but as a path to a script (for example a shell script) which will be executed after the log rotation is finished.

You can even pass arguments to the script, but for this you'll have to use the IFS-variable (separated by a space, the argument would be interpreted as a signal and likely throw an error).

# logfilename       [owner:group] mode count size  when  flags [/cmd_file]
/var/log/myfile.log root:wheel    644  20    10000 *     ZR    /path/to/my/script${IFS}myargument
Georg Pfolz
  • 1,416
  • 2
  • 12
  • 12