Hello,
I am using Armbian 21.02.1 Focal with Linux 5.10.12-sunxi (Armbian Focal from https://www.armbian.com/orange-pi-zero/).
I use the default logrotate configuration (ratate logs in /var/log) but I have a problem that the /var/log/syslog file is still growing (even if logrotate is run daily).
Currently the logrotate process takes place in 3 steps (see /etc/systemd/system/logrotate.service -> [Service] section):
1) ExecStartPre =/usr/lib/armbian/armbian-ramlog write (ramlog write files to update log.hdd before rotation)
2) ExecStart =/usr/sbin/logrotate /etc/logrotate.conf (Logrotate)
3) ExecStartPost =/usr/lib/armbian/armbian-ramlog postrotate (ramlog postrotate (which will copy to/var/log the modified files of /var/log.hdd)
I think step 3 is wrong.
Assume that the following are performed during the logrotate:
1) ExecStartPre =/usr/lib/armbian/armbian-ramlog write = ramlog write (to update log.hdd before rotation) - it is ok
2) the system writes another data to /var/log/syslog (at this moment /var/log/syslog <> /var/log.hdd/syslog)- that's ok
3) ExecStart =/usr/sbin/logrotate /etc/logrotate.conf = logrotate is performed (/var/log/syslog is renamed to /var/log/syslog.1, an empty /var/log/syslog is created, the system starts writing to the new empty /var/log/syslog). - it is OK
4) the system writes data to new /var/log/syslog (at this step /var/log/syslog is not empty) - that's ok
5) ExecStartPost =/usr/lib/armbian/armbian-ramlog postrotate = the ramlog postrotate is started. During postrotate are executed commands (cat /var/log.hdd/... > /var.log/...), which copy files from /var/log.hdd to /var.log).
The command "cat $ file> $ dest" overwrites data in new /var/log/syslog with data from the old /var/log.hdd/syslog - so data written to syslog in step 4 is lost - this is a bug in my opinion
Another consequence of ramlog postrotate is that the new file /var/log/syslog is filled with the data that was written to syslog in the past (so the /var/log/syslog file is still growing).
Proposed solution is to change etc/systemd/system/logrotate.service -> [Service] section as follows:
[Service]
Type=oneshot
ExecStart=/usr/sbin/logrotate /etc/logrotate.conf
ExecStartPost=/usr/lib/armbian/armbian-ramlog write
There are no lost entries in the syslog in this solution.