Error in syslog logrotate command sequence?

Jim McLaughlin

• March 16, 2025 15:12

For weeks, I've been getting an error that took some time to dig into.

It appears that in some relatively recent update, the syslog logrotate file was changed to:

/var/log/cron
/var/log/maillog
/var/log/messages
/var/log/secure
/var/log/spooler
{
    missingok
    sharedscripts
    postrotate
    compress
        /usr/bin/systemctl -s HUP kill rsyslog.service >/dev/null 2>&1 || true
    endscript
}

This started kicking an error because the postrotate command should be AFTER the compress command.

I'm going to switch them around, and monitor, but I wanted to share this and see if this is consistent with anyone else's experience.

• 

  cPRex Jurassic Moderator

  • March 18, 2025 14:07

  Hey there!  I just checked a default cPanel version 126 machine and this is what I see inside /etc/logrotate.d/syslog

  /var/log/cron
  /var/log/maillog
  /var/log/messages
  /var/log/secure
  /var/log/spooler
  {
      missingok
      sharedscripts
      postrotate
          /usr/bin/systemctl -s HUP kill rsyslog.service >/dev/null 2>&1 || true
      endscript
  }

  so I'm not seeing the "compress" option there by default.  Was that added manually at some point possibly?

  0
• 

  Jim McLaughlin

  • March 18, 2025 14:28

  I would have had no reason to change it.

  This is helpful, and I will make sure I'm consistent with the default, which is fine.

  Appreciate the assistance!

  0
• 

  cPRex Jurassic Moderator

  • March 18, 2025 14:34

  You're very welcome!

  0

Please sign in to leave a comment.