1

The host is a docker container running Ubuntu 14.04

I am trying to figure out why the primary log files are not being written too, I have attached output of the files and permissions. I am hoping to figure out why this is occurring as my log files are not being written or rotated properly.

root@1485f0c1fad4:/var/log# ll
total 4124
drwxrwxr-x  9 root   syslog    4096 Oct  3 11:48 ./
drwxr-xr-x 21 root   root      4096 Sep 26 06:25 ../
-rw-r--r--  1 root   root         0 Oct  1 13:08 alternatives.log
-rw-r--r--  1 root   root     13742 May  9 10:26 alternatives.log.1
drwxr-xr-x  2 root   root      4096 Oct  1 13:08 apt/
-rw-r-----  1 syslog adm          0 Oct  1 13:08 auth.log
-rw-r-----  1 syslog adm    2529538 Sep 30 23:10 auth.log.1
-rw-r--r--  1 root   root     47816 Apr 12  2016 bootstrap.log
-rw-rw----  1 root   utmp         0 Oct  1 13:08 btmp
-rw-rw----  1 root   utmp         0 Apr 12  2016 btmp.1
-rw-r-----  1 root   adm         31 Apr 12  2016 dmesg
-rw-r--r--  1 root   root         0 Oct  1 13:08 dpkg.log
-rw-r--r--  1 root   root    279689 May  9 10:26 dpkg.log.1
-rw-r--r--  1 root   root      3264 Apr 12  2016 faillog
drwxr-xr-x  2 root   root      4096 Apr 12  2016 fsck/
-rw-r-----  1 syslog adm          0 Oct  1 13:08 kern.log
-rw-r-----  1 syslog adm        109 Sep 25 15:27 kern.log.1
-rw-rw-r--  1 root   utmp     29784 Apr 12  2016 lastlog
drwxr-xr-x  2 root   root      4096 Sep 25 15:27 supervisor/
-rw-r-----  1 syslog adm          0 Sep 27 06:25 syslog
-rw-r-----  1 syslog adm    1262760 Sep 30 22:43 syslog.1
drwxr-xr-x  2 root   root      4096 Apr 11  2014 upstart/
-rw-rw-r--  1 root   utmp         0 Oct  1 13:08 wtmp
-rw-rw-r--  1 root   utmp         0 Apr 12  2016 wtmp.1

Here is the potentially relevant information from the dockerfile, let me know if there is a problem with that syslog line.

FROM ubuntu:latest

RUN apt-get update -y && apt-get install -y build-essential python-pip python-dev libxml2-dev libxslt-dev libssl-dev libffi-dev libkrb5-dev sshpass python-yaml cron git supervisor python-urllib3

# Syslog related
COPY misc/10-rsyslog.conf /etc/rsyslog.d/01-rsyslog.conf

RUN echo "0-30/15 6-7 * * 6 root bash -c 'cd /root/xxx; python xxx.py >> /root/xxx/output/cron.log 2>&1'" >> /etc/crontab

# Clean up APT when done.
RUN apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*

rsyslog.conf

root@1485f0c1fad4:~/xxx# cat /etc/logrotate.d/rsyslog
/var/log/syslog
{
        rotate 7
        daily
        missingok
        notifemp

ty
            delaycompress
            compress
            postrotate
                    reload rsyslog >/dev/null 2>&1 || true
            endscript
    }

    /var/log/mail.info
    /var/log/mail.warn
    /var/log/mail.err
    /var/log/mail.log
    /var/log/daemon.log
    /var/log/kern.log
    /var/log/auth.log
    /var/log/user.log
    /var/log/lpr.log
    /var/log/cron.log
    /var/log/debug
    /var/log/messages
    {
            rotate 4
            weekly
            missingok
            notifempty
            compress
            delaycompress
            sharedscripts
            postrotate
                    reload rsyslog >/dev/null 2>&1 || true
            endscript
    }
  • Would you post your /etc/logrotate.d/01-rsyslog.conf? Looks like it's not the only one involved but it will help investigating. – Shlublu Oct 3 '17 at 16:24
  • Just updated with logrotate.d/rsyslog – Pythonic Oct 3 '17 at 16:40
  • @Pyhtonic Thanks. They look almost alike if I compare with mine. Is notifempty cut that way in your file? (I don't think it could be the cause though). Also, I have invoke-rc.d rsyslog rotate > /dev/null instead of your reload rsyslog >/dev/null 2>&1 || true but if this comes from the default config of Ubuntu 14 (I'm running a 16) there's no reason for it to prevent the daemon from writing... Especially knowing that your .1files are not empty. (Thinking loud, sorry) – Shlublu Oct 3 '17 at 22:01
  • How are you managing the running services inside your container? i.e. what is the CMD in the Dockerfile. I'm guessing reload rsyslog command is not restarting rsyslog so it remains writing to the files that were moved to x.1. – Matt Oct 10 '17 at 5:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.