Logrotate 0 byte file

UNIX for Beginners Q & A
1

Hello,

For various reasons I decided to rebuild my log server on a new microSD. To simplify matters I restored a backed up copy of the appropriate config files and uploaded them to the new log server once syslog-ng was setup. The issue I am running into now is when logrotate compresses the log file it compresses the file and either creates or leaves another one that 0 bytes.

In the syslog-ng file below I have tried to add nocreate and copytruncate and that didn't change a thing.

/var/log/mikrotik/mikrotik.*.log
{
        rotate 2
        daily
        compress
        missingok
        notifempty
        postrotate
                invoke-rc.d syslog-ng reload > /dev/null
        endscript
}

Reviewing the logrotate.conf file I see no indication of either create or copytruncate being uncommented. There has only been one day that the 0 byte file wasn't created and that was when I uncommented "create" saved and restarted syslog-ng and commented it out saved and restarted syslog-ng but it came back the nexdt night.

# see "man logrotate" for details
# rotate log files weekly
daily

# keep 4 weeks worth of backlogs
rotate 2

# create new (empty) log files after rotating old ones
#create

# uncomment this if you want your log files compressed
compress

# packages drop log rotation information into this directory
include /etc/logrotate.d

# no packages own wtmp, or btmp -- we'll rotate them here
/var/log/wtmp {
    missingok
    monthly
    create 0664 root utmp
    rotate 1
}

/var/log/btmp {
    missingok
    monthly
    create 0660 root utmp
    rotate 1
}

# system-specific logs may be configured here

Why is this file being left/created? Am I missing a file somewhere or is there something in the config that causing this issue. I also do not have this provlem on the log server that the config files were copied from which is why i am at a loss. I don't want to just

Syslog-ng.conf

@include "scl.conf"

# Syslog-ng configuration file, compatible with default Debian syslogd
# installation.

# First, set some global options.
options { chain_hostnames(off); flush_lines(0); use_dns(no); use_fqdn(no);
          owner("root"); group("adm"); perm(0644); stats_freq(0);
          bad_hostname("^gconfd$");
};

# Accept connection on UDP
source s_net { udp (); };

# MIKROTIK ###########
# Add Filter to add our mikroti
filter f_mikrotik { host( "192.168.88.1" ); };
# Add destination file where logs will be stored
#destination df_mikrotik { file("/home/pi/files/mikrotik.log"); };
log { source ( s_net ); filter( f_mikrotik ); destination ( df_mikrotik ); };
destination df_mikrotik {
file("/var/log/mikrotik/mikrotik.${YEAR}.${MONTH}.${DAY}.log"
template-escape(no));
};

########################
# Sources
########################
# This is the default behavior of sysklogd package
# Logs may come from unix stream, but not from another machine.
#
source s_src {
       system();
       internal();
};
2

logrotate is awful.

man logrotate

does not well enough clarify boarder cases.
Try to add
sharedscripts
This ensures that the postrotate action occurs once.
It work as well (or even better) to replace postrotate with lastaction (then you do not need sharedscripts ).

1 Like
3

Thanks, going to give a try!

4

So two mornings in a row now and my 0 byte files are not present. Thank you very much.

1 Like