[syslog-ng] Logs rotate and compress but still log to compressed file

[Nate Campi]

On Tue, May 17, 2005 at 08:39:36AM -0400, Rechtorik, Keith wrote:
> I am running SUSE 9.1 and I have syslog-ng logging information from our PIX.
> After a rotate is done the file is compressed and rotated but syslog-ng
> keeps logging to the compressed file instead of the newly created file. Any
> help would be greatly appreciated. Here are my conifgs. If you need anymore
> information I will gladly send it.
> 
> /etc/logrotate.d/syslog
> 
> /var/log/pix/voclog {
>     rotate 4
>     daily
>     compress
>     delaycompress
> postrotate
> #    kill -HUP `cat /var/run/syslog-ng.pid`
> #     /bin/kill -HUP `cat /var/run/syslog-ng.pid 2> /dev/null` 2> /dev/null
> ||true
>      /etc/init.d/syslog reload
>      /etc/init.d/apache2 reload
> endscript
> }

You need to run logrotate by hand and look for errors, like maybe
/var/run/syslog-ng.pid doesn't have the right PID for some reason
(though you should make it NOT redirect STDERR to /dev/null - ignoring
error output is rarely good) or some other
shouldn't-happen-but-apparently-is-in-your-case error.

Move onto syslog-ng once you're sure logrotate is really HUP'ing it
(check logs from syslog-ng, make sure it's logging the internal() source
somewhere).
-- 
Nate

"Get your facts first, and then you can distort them as much as you 
please." - Samuel Clemens