From Bugzilla Helper: User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Linux 2.4.9-2 i686) Opera 7.11 [en] Description of problem: [root@inbound1 root]# ls -l /var/log/maillog* -rwxr-xr-x 1 root root 0 May 25 00:02 /var/log/maillog -rwxr-xr-x 1 root root 497165956 May 25 00:06 /var/log/maillog.1 -rw------- 1 root root 69582848 May 25 00:06 /var/log/maillog.1.gz -rwxr-xr-x 1 root root 61913158 May 24 00:02 /var/log/maillog.2.gz I noticed while logrotate was running that it rotated the maillog above, but that it apparently started zipping it before sending HUP to syslogd...so syslogd continued writing to the rotated file as it was being gzipped. [root@inbound1 root]# cat /etc/logrotate.d/syslog /var/log/messages /var/log/secure /var/log/maillog /var/log/spooler /var/log/boot.log /var/log/cron /var/log/kernel{ rotate 7 daily sharedscripts postrotate /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true endscript compress } According to this bit from the man page, this shouldn't happen. The next section of the config files defined how to handle the log file /var/log/messages. The log will go through five weekly rotations before being removed. After the log file has been rotated (but before the old version of the log has been compressed), the command /sbin/killall -HUP syslogd will be executed. Version-Release number of selected component (if applicable): logrotate-3.6.4-1 How reproducible: Didn't try Steps to Reproduce: Just logrotate a really big file so you have time to see what's happening as I did. Expected Results: HUP should have been sent to syslogd before starting to compress the rotated file. Additional info:
The problem is that the 'sharedscripts' flag is set, causing the post-rotate script to be run once after the rotate&compress cycle is run on all the logfiles. The most recent sysklog package no longer compresses its logfiles.