rsyslogd rotation.sizeLimitCommand problem

README.md

SOLVED The issue was the way I was running rsyslogd. Running it as rsyslogd -n & from init.sh fixes the issue.

I am exploring an issue that I am having where a rsyslog rotation.sizeLimitCommand apparently may not produce any output at all, otherwise it fails.

On a host that has Docker installed, run the test via ./run.sh; just wait a few seconds for the file to reach 1kB in size. To see the problem, uncomment the echo line in logrotate.sh and run the test again.

I can't yet tell from the source why this might be the case:

• https://github.com/rsyslog/rsyslog/blob/e7404b2/runtime/stream.c#L145
• https://github.com/rsyslog/rsyslog/blob/e7404b2/runtime/srutils.c#L274

Dockerfile

FROM debian:bookworm-slim

RUN apt-get update && apt-get install -y --no-install-recommends rsyslog

COPY rsyslog.d-demo.conf /etc/rsyslog.d/00-demo.conf
RUN mkdir -vp /var/log/user
# this command just comments out kernel logging support (the line `module(load="imklog")`)
RUN perl -wMstrict -i -ple 's/^(?=\s*module\s*\(\s*[^)]*\bimklog\b)/#/' /etc/rsyslog.conf

COPY *.sh /usr/local/bin/
RUN chmod -c 555 /usr/local/bin/*.sh
CMD [ "/usr/local/bin/init.sh" ]

fill-log.sh

#!/bin/bash
set -euo pipefail
while true; do
    sleep 1
    logger "Directory contents: $(find /var/log/user ! -type d -printf '%P %s; ')"
done

init.sh

#!/bin/bash
set -meuxo pipefail
rsyslogd -n &
/usr/local/bin/fill-log.sh &
tail -s0.1 -q -F /var/log/user/user.log /var/log/syslog /tmp/log.txt

logrotate.sh

#!/bin/bash
set -euo pipefail
cd /var/log/user
echo "$(date -Ins) Running move and gzip" >>/tmp/log.txt
echo "No Kaboom"
mv -v user.log user.log.1
gzip --force user.log.1
echo "$(date -Ins) Move and gzip ok" >>/tmp/log.txt

rsyslog.d-demo.conf

if ( $syslogfacility-text == "user" ) then {
    action(type="omfile" File="/var/log/user/user.log"
            rotation.sizeLimit="1024"
            rotation.sizeLimitCommand="/usr/local/bin/logrotate.sh")
    stop
}

run.sh

#!/bin/bash
set -euxo pipefail
docker container run -it --rm --init "$(docker build -q .)" "$@"