You are using an RSyslog mechanism to send your logs to a centralized server, but as soon as the logrotate is executed on the server, no log is sent anymore?
I will explain here why this can happen and how to fix it properly.
In logrotate, when rotation is happening the old file is renamed and a new file is created. But some processes do not care about the filename change and keep their file descriptor on the older file (whatever the name/extension is). To avoid that kind of problem, you need to use copytruncate option in logrotate so this process can start writing to the new file.
Due to his previous option copytruncate, logrotate is working fine, but rsyslog doesn’t understand that the file has changed (truncated) and is acting like a tail -f command staying stuck on this truncated state and not sending logs anymore…
To avoid that, you have to specify a lastscript option when logrotate has been executed to renew the rsyslog spool and state of the file.
As an example, here is how a logrotate script could look like to be working fine in such a case:
/var/log/myapp/*
{
copytruncate
compress
daily
rotate 7
notifempty
missingok
lastaction
service rsyslog stop
rm /var/spool/rsyslog/MyApp-*
service rsyslog start
endscript
}
The “rm /var/spool/rsyslog/MyApp-*” line has to be adapted depending on the InputFileStateFile name you used in your rsyslog configuration.