Syslog drop-in for logrotate.d missing

Support
1

I may have missed this in the past, or fixed and have forgotten, for the many Alma8 and RHEL8 hosts there has always been a drop-in “syslog” in logrotate.d, recently stood up a few Alma9 hosts and there is no syslog file, which rotates cron, messages and secure.

Here is an example from an Alma8, note I did add a few extra to log rotate, sudo, etc.

/var/log/sudo.log
/var/log/cron
/var/log/syslog
/var/log/maillog
/var/log/messages
/var/log/secure
/var/log/spooler
/var/log/daemon.log
/var/log/kern.log
{
    missingok
    sharedscripts
    postrotate
           /bin/kill -HUP `cat /var/run/rsyslogd.pid` 2> /dev/null || true
   endscript
}

Should it be there just like it is with Alma8?

2

yum install rsyslog-logrotate

3

If you have a decent guess on the name of the missing file, you can check which repos do offer it (if any):

[AlmaLinux 8 ~]# dnf provides /etc/logrotate.d/\*syslog\*
...
rsyslog-8.2102.0-15.el8_10.1.x86_64 : Enhanced system logging and kernel message trapping daemon
Repo        : appstream
Matched from:
Filename    : /etc/logrotate.d/syslog


[AlmaLinux 9 ~]# dnf -q provides /etc/logrotate.d/\*syslog\*
...
rsyslog-logrotate-8.2310.0-4.el9.x86_64 : Log rotation for rsyslog
Repo        : appstream
Matched from:
Filename    : /etc/logrotate.d/rsyslog
4

Thank you both.

dnf install rsyslog-logrotate

Fixed it for me.

The rsyslog conf file for system logs not being there, has it always been that way?

I ask as it has been some time since I’ve done a “install from ISO from scratch”, this was a special case, and I chose the 'minimum ISO", and I’m wondering if this is something related to using the minimal install, and if I had used the regular install rsyslog-logrotate would have been included.

I also noted that on our early Alma8 hosts, it uses a syslog rotate file, not rsyslog.

These days I usually use a hardened template and then apply a salt state for all the rest, so have lost some hands-on bare-bones install knowledge.

5

dnf group info minimal-environment shows that the Minimal Install on AlmaLinux 9 does have “Core” as mandatory group.
dnf group info core does show that the “Core” has ‘rsyslog’ as mandatory package.
So even the “minimum ISO” of Alma 9 ought to install the rsyslog

However, the

dnf rq --whatrequires rsyslog-logrotate
dnf rq --groupmember rsyslog-logrotate

tell that nothing pulls that package explicitly.

Cloud images have different package sets, but that is a different story.

Logs are primarily handled by systemd-journald and kept only in RAM – not kept forever.
The latest rsyslog simply copies some of the messages from systemd-journald (into logs).

One can enable the systemd-journald to store logs in files directly:

The journal service stores log data either persistently below /var/log/journal or in a volatile way below /run/log/journal/ (in the latter case it is lost at reboot). By default, log data is stored persistently if /var/log/journal/ exists during boot, with an implicit fallback to volatile storage otherwise. Use Storage= in journald.conf(5) to configure where log data is placed, independently of the existence of /var/log/journal/.

One does read those files with journalctl

I have not looked whether there is rotate mechanism for journald.

IIRC, the early el8 (e.g. CentOS 8) did not install rsyslog with Minimal – just the journald.