Hello,
I am using Armbian 21.02.1 Focal with Linux 5.10.12-sunxi (Armbian Focal from https://www.armbian.com/orange-pi-zero/).

I use the default logrotate configuration (ratate logs in /var/log) but I have a problem that the /var/log/syslog file is still growing (even if logrotate is run daily). 
Currently the logrotate process takes place in 3 steps (see /etc/systemd/system/logrotate.service -> [Service] section):

1) ExecStartPre =/usr/lib/armbian/armbian-ramlog write (ramlog write files to update log.hdd before rotation) 
2) ExecStart =/usr/sbin/logrotate /etc/logrotate.conf (Logrotate)
3) ExecStartPost =/usr/lib/armbian/armbian-ramlog postrotate (ramlog postrotate (which will copy to/var/log the modified files of /var/log.hdd)

I think step 3 is wrong.

Assume that the following are performed during the logrotate:
1) ExecStartPre =/usr/lib/armbian/armbian-ramlog write  = ramlog write (to update log.hdd before rotation) - it is ok
2) the system writes another data to /var/log/syslog (at this moment /var/log/syslog <> /var/log.hdd/syslog)- that's ok
3) ExecStart =/usr/sbin/logrotate /etc/logrotate.conf = logrotate is performed (/var/log/syslog is renamed to /var/log/syslog.1, an empty /var/log/syslog is created, the system starts writing to the new empty /var/log/syslog). - it is OK
4) the system writes data to new /var/log/syslog (at this step /var/log/syslog is not empty) - that's ok
5) ExecStartPost =/usr/lib/armbian/armbian-ramlog postrotate = the ramlog postrotate is started. During postrotate are executed commands (cat /var/log.hdd/... > /var.log/...), which copy files from /var/log.hdd to /var.log). 
The command "cat $ file> $ dest" overwrites data in new /var/log/syslog with data from the old /var/log.hdd/syslog - so data written to syslog in step 4 is lost - this is a bug in my opinion

Another consequence of ramlog postrotate is that the new file /var/log/syslog is filled with the data that was written to syslog in the past (so the /var/log/syslog file is still growing).

 

Proposed solution is to change etc/systemd/system/logrotate.service -> [Service] section as follows:

[Service]
Type=oneshot
ExecStart=/usr/sbin/logrotate /etc/logrotate.conf
ExecStartPost=/usr/lib/armbian/armbian-ramlog write

 

There are no lost entries in the syslog in this solution.

If you think it's wrong, submit a change via pull request?

 

https://github.com/armbian/build/pulls

@tparys - thank you for your reply but I am new here, and I am not sure, if I am able to create pull request...

I assure you that you can, and it's encouraged (see HERE).

• Fork the repository on github
• Make a change to your copy
• Hit the button to create a merge request

I noticed the same issue. I can submit a change. However, I am not familiar with armbian-ramlog program. So, I guess I will first see what this program does.

 

On my armbian I just commented out ExecStartPost in logrotate.service, and now logs are no longer rewritten with old data after rotation. I am not sure that is the correct way as I am not sure how it is supposed to rotate and archive logs.

@noone - you commented out ExecStartPost -> so your logfiles are not written to the SD card  (/var/log.hdd). you will lost all your logs located in /var/log on power failure.

 

@noone - I made a mistake - commented out ExecStartPost is ok from my point of view.

Hello, 

I registered that after upgrading to Armbian 21.05.1 the behaviour of /usr/sbin/logrotate /etc/logrotate.conf was changed.

Currently, step "3) ExecStart = /usr/sbin/logrotate /etc/logrotate.conf" is performed in the /var/log.hdd/ directory (in the previous version this step was performed in the /var/log directory).

 

So after the upgrade, I changed:
1) in /etc/logrotate.d/rsyslog:
/var/log.hdd/syslog -> /var/log/syslog

2) in the /etc/systemd/system/logrotate.service [Service] section as follows:
[Service]
Type = oneshot
ExecStart = / usr / sbin / logrotate /etc/logrotate.conf
ExecStartPost = / usr / lib / armbian / armbian-ramlog write

 

After these changes logrotate works according to my expectations again.