Logs are written to *.log.1 instead of *.log

For some reason my log files on my server (Ubuntu 12.04 LTS) are writing to the *.log.1 files instead of the *.log files, e.g. for my Postfix log files it is writing to /var/log/mail.log.1 and not /var/log/mail.log as expected. Same goes for mail.err.

It looks like it's also doing it for auth.log and syslog. Here is a ls -lt snippet of my /var/log directory, showing the more recently touched log files in reverse chronological order

$ ls -lt /var/log/
-rw-r----- 1 syslog    adm      5389672 Dec 20 01:30 auth.log.1
-rw-r----- 1 syslog    adm      5596428 Dec 20 01:30 syslog.1
-rw-r----- 1 syslog    adm      3351752 Dec 20 01:29 mail.log.1
-rw-r----- 1 root      adm       375366 Dec 20 01:28 denyhosts
-rw-r----- 1 root      adm         3028 Dec 19 19:52 fail2ban.log
-rw-r----- 1 syslog    adm            0 Dec 19 06:29 kern.log
-rw-r----- 1 mysql     adm            0 Dec 19 06:29 mysql.log
-rw-r--r-- 1 root      root           0 Dec 19 06:29 procmail.log
-rw-r----- 1 syslog    adm          495 Dec 19 03:40 kern.log.1
...

And here's just the mail files:

$ ls -l /var/log/mail.*
-rw-r----- 1 syslog adm       0 Dec  9 06:51 /var/log/mail.err
-rw-r----- 1 syslog adm     887 Dec  6 13:45 /var/log/mail.err.1
-rw-r----- 1 syslog adm     129 Nov 30 01:57 /var/log/mail.err.2.gz
-rw-r----- 1 syslog adm       0 Dec 16 06:31 /var/log/mail.log
-rw-r----- 1 syslog adm 3352098 Dec 20 01:32 /var/log/mail.log.1
-rw-r----- 1 syslog adm  331704 Dec  9 06:45 /var/log/mail.log.2.gz
-rw-r----- 1 syslog adm  235751 Dec  2 06:40 /var/log/mail.log.3.gz

Is there something that is misconfigured? I restarted postfix and it still wrote to mail.log.1 afterwards. The mail logs rotate weekely on sunday @ 6:30am so it looks like maybe the logs rotated, but continued to write to the "old" log which is now mail.log.1?

1 Reply

you probably need to send a SIGHUP to rsyslogd, or service rsyslog reload.

the logrotate script should do that automatically, it seems to have been mis-configured, or something.

edit:

or perhaps something happened to /var/run/rsyslogd.pid

check out /etc/logrotate.d/rsyslog, too

Reply

Please enter an answer
Tips:

You can mention users to notify them: @username

You can use Markdown to format your question. For more examples see the Markdown Cheatsheet.

> I’m a blockquote.

I’m a blockquote.

[I'm a link] (https://www.google.com)

I'm a link

**I am bold** I am bold

*I am italicized* I am italicized

Community Code of Conduct