Bug 2369650 - Call `systemctl reload` in logrotate postrotate script
Summary: Call `systemctl reload` in logrotate postrotate script
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: syslog-ng
Version: 42
Hardware: Unspecified
OS: Linux
unspecified
low
Target Milestone: ---
Assignee: Peter Czanik
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-06-01 19:38 UTC by Marcos Mello
Modified: 2025-06-19 01:58 UTC (History)
2 users (show)

Fixed In Version: syslog-ng-4.8.2-3.fc43 syslog-ng-4.8.2-5.fc42
Clone Of:
Environment:
Last Closed: 2025-06-19 01:58:56 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Marcos Mello 2025-06-01 19:38:20 UTC
Since syslog-ng.service sends SIGHUP to the service's main PID upon being reloaded

```
ExecReload=/bin/kill -HUP $MAINPID
```

the logrotate configuration snippet can be simplified with `systemctl reload`, eliminating the need to use the PID file.

```
/bin/systemctl reload syslog-ng.service >/dev/null 2>&1 || true
```

Example usage (httpd):

https://src.fedoraproject.org/rpms/httpd/blob/rawhide/f/httpd.logrotate

Reproducible: Always




Additional Information:
syslog-ng-4.8.2-1.fc42.x86_64

Comment 1 Marcos Mello 2025-06-01 19:43:30 UTC
rsyslog also uses `systemctl reload`:

https://src.fedoraproject.org/rpms/rsyslog/blob/rawhide/f/rsyslog.log

Comment 2 Peter Czanik 2025-06-02 12:30:27 UTC
My unofficial syslog-ng packages had this logrotate at least for the past five years. It also adds "missingok":

```
/var/log/cron
/var/log/maillog
/var/log/messages
/var/log/secure
/var/log/spooler
{
    missingok
    sharedscripts
    postrotate
	/usr/bin/systemctl kill -s HUP syslog-ng.service >/dev/null 2>&1 || true
    endscript
}
```
Would it be OK?

Comment 3 Marcos Mello 2025-06-02 13:05:22 UTC
(In reply to Peter Czanik from comment #2)
> My unofficial syslog-ng packages had this logrotate at least for the past
> five years. It also adds "missingok":
> 
> ```
> /var/log/cron
> /var/log/maillog
> /var/log/messages
> /var/log/secure
> /var/log/spooler
> {
>     missingok
>     sharedscripts
>     postrotate
> 	/usr/bin/systemctl kill -s HUP syslog-ng.service >/dev/null 2>&1 || true
>     endscript
> }
> ```
> Would it be OK?

Unfortunately, no, because the SELinux policy does not allow it. This is being addressed in this bug:

https://bugzilla.redhat.com/show_bug.cgi?id=2369644

Only `systemctl reload` is allowed, which, in the case of syslog-ng.service, works since the signal to reopen the logs is the same as the one used for reloading.

On a related note, `--kill-who=main` is generally recommended in `systemctl kill` calls within postrotate scripts, as it avoids signaling all processes in the service's cgroup, in case the daemon manages child processes on its own. If this behavior of signaling only the main process is important during the termination of the service, consider adding `KillMode=mixed` in the `[Service]` section of the service unit file (more information in the systemd.kill(5) man page).

Comment 4 Fedora Update System 2025-06-06 07:06:01 UTC
FEDORA-2025-e14f3483e3 (syslog-ng-4.8.2-3.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-e14f3483e3

Comment 5 Fedora Update System 2025-06-06 07:11:00 UTC
FEDORA-2025-e14f3483e3 (syslog-ng-4.8.2-3.fc43) has been pushed to the Fedora 43 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 6 Fedora Update System 2025-06-06 07:30:35 UTC
FEDORA-2025-580a8fefe4 (syslog-ng-4.8.2-3.fc42) has been submitted as an update to Fedora 42.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-580a8fefe4

Comment 7 Marcos Mello 2025-06-06 12:53:37 UTC
/bin/systemctl reload syslog-ng.service 2> /dev/null` 2> /dev/null || true

is invalid shell syntax:

line 1: unexpected EOF while looking for matching ``'

Comment 8 Fedora Update System 2025-06-07 08:25:30 UTC
FEDORA-2025-580a8fefe4 has been pushed to the Fedora 42 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-580a8fefe4`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-580a8fefe4

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 9 Marcos Mello 2025-06-09 00:01:26 UTC
Please reopen.

In fact, you can simplify and remove those shell redirections with the try-reload-or-restart verb, which will print nothing and return zero if the service is not running:

/bin/systemctl try-reload-or-restart syslog-ng.service

It's supported since systemd 229, quite old.

Comment 10 Peter Czanik 2025-06-10 06:30:01 UTC
Thanks for spotting this. We had a long weekend (Whit Monday is a public holiday), but updating the packages now.

Comment 11 Fedora Update System 2025-06-10 06:44:10 UTC
FEDORA-2025-4511874820 (syslog-ng-4.8.2-5.fc42) has been submitted as an update to Fedora 42.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-4511874820

Comment 12 Fedora Update System 2025-06-11 04:00:52 UTC
FEDORA-2025-4511874820 has been pushed to the Fedora 42 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-4511874820`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-4511874820

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 13 Fedora Update System 2025-06-19 01:58:56 UTC
FEDORA-2025-4511874820 (syslog-ng-4.8.2-5.fc42) has been pushed to the Fedora 42 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.