3

I have a problem with logging. With my configuration below, I have to perform rsyslog restart if I want to have my application log file in /var/log. Also, I have to restart rsyslog it in case of log rotate. What is the proper configuration of rsyslog and systemd service to avoid rsyslog restart?

My configuration: /etc/rsyslog.d/myapp.conf

if $programname == 'myapp' then {
    /var/log/myapp/myapp.log
    stop
}

/etc/systemd/system/myapp.service

[Unit]
Description=myapp

[Service]
User=myapp
ExecStart=/usr/bin/myapp
StandardOutput=syslog
StandardError=syslog
SyslogIdentifier=myapp

[Install]
WantedBy=multi-user.target

/etc/logrotate.d/myapp.conf

/var/log/myapp/myapp.log {
  rotate 7
  daily
  size 100MB
  compress
  missingok
  notifempty
  postrotate
    sudo systemctl restart rsyslog.service
  endscript
}
6
  • why do you have to restart rsyslog? you may need to restart/reload only the application, rsyslog will handle logrotation fine
    – Bart
    Jun 25, 2019 at 15:18
  • this is the problem. without rsyslog restart logs file are not created
    – Pawel
    Jun 25, 2019 at 16:07
  • Paweł, that's really weird.. are you sure your app is configured to log to the file? from systemd unit it seems it logs to syslog, not particular file.. can you post more information on how the app is configured internally for logging? do you have a redirect in rsyslog for the app?
    – Bart
    Jun 25, 2019 at 17:07
  • according to my knowledge - configuration is ok. stdout stderr goes to syslog, then in rsyslog.config is a redirection to file. But everything requires rsyslog restart
    – Pawel
    Jun 25, 2019 at 18:41
  • did you try using copytruncate in logrotate unit configuration and/or create to create an empty file after rotation?
    – Bart
    Jun 26, 2019 at 7:05

1 Answer 1

2

You should be able to tell rsyslogd to reopen the log-files with something like:

/usr/bin/systemctl kill -s HUP rsyslog.service 

I have not yet found how to make it reload its configuration, most hits says you need to restart it to apply new configuration.

I found this serverfault question that links information it is not possible:
https://serverfault.com/q/1053728/343786

And these posts that tells a little about why it is not possible:
https://rainer.gerhards.net/2008/10/new-rsyslog-hup-processing.html
https://github.com/rsyslog/rsyslog/issues/3759

The later refer to RELP that could be used to avoid loosing log messages during restart, see:
https://en.wikipedia.org/wiki/Reliable_Event_Logging_Protocol

3
  • 1
    The 2008 gerhards.net blog post you link (from the rsyslogd lead) says that SIGHUP, by default, does reload the configuration. However, this says that this behavior was deprecated in v4, and will go away in v5. Apr 18, 2023 at 13:12
  • @DanielGriscom That blog-post is 15 years old, the default have changed, RSyslog is currently at version 8. Besides, the "full restart" he mentions included a loss of service similar to doing a systemctl restart. Apr 19, 2023 at 7:35
  • Then you may want to clarify your answer, which misrepresents what the blog post states. Apr 19, 2023 at 16:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .