Hi Michael,
On 5/18/21 6:42 PM, Michael Biebl wrote:
On Thu, 25 Feb 2021 13:30:40 +0100 Harald Dunkel <harald.dun...@aixigo.com>
My favorite workaround is to kick out the delaycompress, see
https://bugs.debian.org/720096#130.
I still fail to see a convincing explanation, why that would fix this issue.
Its not a fix, but a workaround. I don't know why it works, either,
but I am running >200 Debian hosts without delaycompress. It works.
AFAIU delaycompress tells logrotate to not compress /var/log/messages.1,
because rsyslog might still be writing to it. That is exactly what
is happening, but rsyslog *keeps on* writing it. It doesn't close
messages.1 to open /var/log/messages (created by logrotate) instead.
Apparently the signal "about /var/log/messages" from logrotate to
rsyslog has been lost.
And the notifempty in logrotate.d/rsyslog makes sure that /var/log/\
messages (a zero length file, because nobody is writing to it) is not
rotated again, i.e. messages.1 is never compressed.
But this is just a wild guess.
A clean solution would have to delay sending a SIGHUP to rsyslog,
until *all* rsyslog logfiles have been processed by logrotate,
regardless in which logrotate config file or "{ ... }" block they
are mentioned. Some kind of global "sharedscripts" option.
We basically have a "global sharedscripts" option now, because all log rules
have been merged into one (*).
This is just by chance. I have to distinguish between the mail.*
logfiles and the others in logrotate.d/rsyslog on my MTA, for example.
In this case its not global anymore.
To this date, I've been unable to reproduce the issue, which makes this
really hard to debug.
AFAIU the reason for this problem is already known: A race condition
in the signaling mechanism for the different log files written by the
same rsyslog.
The fix is difficult. logrotate has to tell rsyslog *which* logfiles
have been rotated. Currently rsyslog has to guess. Probably it assumes
that all logfiles have been rotated on the very first signal; thats
why your workaround (the single block in logrotate.d/rsyslog) works.
Regards
Harri
