> ## Content Index
> Fetch the complete content index at: https://www.bagz.fr/llms.txt
> Use this file to discover other available public pages before exploring further.

# Rsyslog stops working after logrotate
- URL: https://www.bagz.fr/rsyslog-stops-working-after-logrotate/
- Published: 2015-05-27T16:49:38.000Z
- Updated: 2015-05-27T16:49:38.000Z
- Author: bgazui
- Tags: Linux, #Migrated-1790668826633, #wp, #wp-post, #Import 2026-09-29 08:00

You are using an **RSyslog** mechanism to send your logs to a centralized server, but as soon as the **logrotate** is executed on the server, no log is sent anymore?

I will explain here why this can happen and how to fix it properly.

In **logrotate**, when rotation is happening the old file is renamed and a new file is created. But some processes do not care about the filename change and keep their file descriptor on the older file (whatever the name/extension is). To avoid that kind of problem, you need to use **copytruncate** option in logrotate so this process can start writing to the new file.

Due to his previous option **copytruncate**, logrotate is working fine, but rsyslog doesn't understand that the file has changed (truncated) and is acting like a **tail -f** command staying stuck on this truncated state and not sending logs anymore...

To avoid that, you have to specify a **lastscript** option when logrotate has been executed to renew the rsyslog spool and state of the file.

As an example, here is how a logrotate script could look like to be working fine in such a case:

/var/log/myapp/\*  
{  
 copytruncate  
 compress  
 daily  
 rotate 7  
 notifempty  
 missingok  
 lastaction  
 service rsyslog stop  
 rm /var/spool/rsyslog/MyApp-\*  
 service rsyslog start  
 endscript  
}

The "

*rm /var/spool/rsyslog/MyApp-\** 

" line has to be adapted depending on the ***InputFileStateFile*** name you used in your rsyslog configuration.