00willo
commented
1 year ago This may be related, but after setting up, the sysmon.log was renamed, and a new sysmon.log was created, however, the handle hadn't been released and sysmon was still writing to the old (now renamed) file.
Running systemctl restart sysmon still didn't work correctly, I finally managed to get it to complete the rotation by running /usr/lib/rsyslog/rsyslog-rotate manually. I've added it to the script to see if it works consistently.
The only change made to the logrotate conf, was to use dateext and dateformat for the rotated logs
/var/log/sysmon/sysmon.log {
rotate 30
daily
missingok
delaycompress
compress
create 640 root adm
sharedscripts
dateext
dateformat -%Y%m%d
postrotate
if invoke-rc.d sysmon status > /dev/null 2>&1; then \
invoke-rc.d sysmon restart > /dev/null 2>&1; \
fi;
endscript
}Distro/kernel version Debian 11 kernel 5.10.0-18-amd64
$ dpkg -l | grep -iE 'sysmonforlinux|bpf'
ii libbpf0:amd64 1:0.3-2 amd64 eBPF helper library (shared library)
ii sysinternalsebpf 1.0.2 amd64 A shared library and code library for making eBPF programs.
ii sysmonforlinux 1.0.2 amd64 A system monitor based on eBPF, ported from Windows, that outputs events to Syslog$ lsof /var/log/sysmon/sysmon.log
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
rsyslogd 466 root 7w REG 254,0 37018631 3409500 /var/log/sysmon/sysmon.log
juju4
Describe the bug sysmon service is active but no logs is written.
more precisely logs are visible via journalctl but not via log file /var/log/sysmon/sysmon.log log file output set by https://github.com/juju4/ansible-sysmon/blob/main/templates/rsyslog-sysmon.conf.j2
To Reproduce Setup with https://github.com/juju4/ansible-sysmon/ Let it run for few days to get logrotation
Sysmon version
Distro/kernel version Ubuntu 22.04.2 LTS kernel 5.19.0-1022-aws
Sysmon configuration
https://github.com/juju4/ansible-sysmon/blob/main/templates/config.xml.j2 but seems to have been resetted somewhere... not sure if installer is doing something like that like it does for systemd unit service file.
Logs Empty config
Expected config from ansible role
Expected behavior Logs should be available both in journalctl and sysmon.log
Additional context Collected Apr 15th.
Note that logrotate includes a service restart so likely not an issue there. some days fine, some not