1

Actually, i have an issue with rsyslog.

When rsyslog should rotate the log (via logrotate); i got this issue :

gzip: standard input: Bad file descriptor
error: failed to compress log /var/log/messages-20190716-1563261724

If i run via logrotate, as it mentionned in rsyslog conf, it works great :

$outchannel messages,/var/log/messages,60000000,/usr/sbin/logrotate /etc/logrotate.conf

So, here my conf :

/etc/logrotate.d/syslog:

/var/log/messages
{
# !! Rotate size must be less than in rsyslog.conf (60M !!)
size 50M
rotate 4
compress
sharedscripts
postrotate
/bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
/bin/kill -HUP `cat /var/run/rsyslogd.pid 2> /dev/null` 2> /dev/null || true
endscript
}

/etc/rsyslog.conf:

$ModLoad imklog
$ModLoad imuxsock
$ModLoad imtcp.so # load module
# Maximum TCP sessions (default 200)
$InputTCPMaxSessions 1024
# start up TCP listener at port 514
$InputTCPServerRun 514
# Where to place spool files
$WorkDirectory /export/rsyslog
# infinite retries on insert failure
$ActionResumeRetryCount -1
# save in-memory data if rsyslog shuts down
$ActionQueueSaveOnShutdown on
# Don't slow down dequeuing
$ActionQueueDequeueSlowdown 0
# Queue Types
$MainMsgQueueType FixedArray
$ActionQueueType FixedArray
# Become DA (Disk Assisted Queues)
$MainMsgQueueFileName mainq
$ActionQueueFileNAme actionq
# Disable Rate Throttling (avoids system hang?)
$MainMsgQueueTimeoutEnqueue 0
$ActionQueueTimeoutEnqueue 0
# Set Max Disk space usage
$MainMsgQueueMaxDiskSpace 2g
$ActionQueueMaxDiskSpace 2g
# Message queue size (default 10000)
$MainMsgQueueSize 100000
$ActionQueueSize 100000
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
$IncludeConfig /etc/rsyslog.d/*.conf
# Rotate when reaching 60M => see /etc/logrotate.d/syslog
$outchannel messages,/var/log/messages,60000000,/usr/sbin/logrotate /etc/logrotate.conf

and I have rsyslog Warning in my /var/log/messages:

Jul 17 14:11:52 hoodriver rsyslogd: [origin software="rsyslogd" swVersion="5.8.10" x-pid="28100" x-in
fo="http://www.rsyslog.com"] start
Jul 17 14:11:52 hoodriver rsyslogd: WARNING: rsyslogd is running in compatibility mode. Automatically
 generated config directives may interfer with your rsyslog.conf settings. We suggest upgrading your
config and adding -c5 as the first rsyslogd option.
Jul 17 14:11:52 hoodriver rsyslogd-2184: action '$printk' treated as ':omfile:$printk' - please chang
e syntax, '$printk' will not be supported in rsyslog v6 and above. [try http://www.rsyslog.com/e/2184
 ]

Thank's in advance for your help

  • Could you post the output of getenforce and ls -laZ /var/log/messages*? If getenforce returns "Enforced", please edit your post and add the output of cat /var/log/audit/audit.log* | grep messages | ausearch -i. – Edward Jul 17 at 12:01
  • Hi @Edward, unfortunately selinux is disabled and I don't have any information in audit.log – kileurf Jul 17 at 12:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.