Logrotate Error

Hi all,

I have installed syslog-ng (balabit/syslog-ng) in a docker container and pointed OMV to it and it is working fine.

I want to be able to rotate the logs so I'm using syslog-ng's built-in logrotate file /etc/logrotate.d/syslog-ng:

root@omv:/etc# docker exec syslog-ng cat /etc/logrotate.d/syslog-ng
/var/log/syslog
{
rotate 7
daily
missingok
notifempty
delaycompress
compress
postrotate
invoke-rc.d syslog-ng reload > /dev/null
endscript
}


/var/log/mail.info
/var/log/mail.warn
/var/log/mail.err
/var/log/mail.log
/var/log/daemon.log
/var/log/kern.log
/var/log/auth.log
/var/log/user.log
/var/log/lpr.log
/var/log/cron.log
/var/log/debug
/var/log/messages
/var/log/error
{
rotate 4
weekly
missingok
notifempty
compress
delaycompress
sharedscripts
postrotate
invoke-rc.d syslog-ng reload > /dev/null
endscript
}
root@omv:/etc#

However I'm getting the following error:

root@omv:/etc# docker exec syslog-ng /usr/sbin/logrotate -f /etc/logrotate.d/syslog-ng
invoke-rc.d: could not determine current runlevel
invoke-rc.d: policy-rc.d denied execution of reload.
root@omv:/etc# 

The problem seems to be doing the reload of syslog-ng.

I've tried several ideas that I found on the internet but none has fixed the problem.

Any ideas greatly appreciated.

TIA

I'm sorry but I am confused. Your syslog-ng link goes to a page that says:

With the Your central log server in Docker link going to a page saying:

docker run -it -v /data/syslog-ng/conf/syslog-ng.conf:/etc/syslog-ng/syslog-ng.conf -v /data/syslog-ng/logs:/var/log -p 514:514 -p 601:601 –name syslog-ng balabit/syslog-ng:latest -edv

Note the name of the image is the same as the one I'm using.

EDIT: I get the same result running the logrotate command either inside or outside the container.

After many hours of searching I have found the answer, so I will post it here in case others have the same problem.

Syslog-ng needs specific POSIX capability flags. But docker does not grant them by default.

Here's my docker run command:

docker run -d \
--name syslog-ng \
--cap-add NET_BIND_SERVICE \
--cap-add NET_BROADCAST \
--cap-add NET_RAW \
--cap-add DAC_READ_SEARCH \
--cap-add DAC_OVERRIDE \
--cap-add CHOWN \
--cap-add SYSLOG \
-p 514:514/udp \
-p 601:601 \
-e PUID=1000 \
-e PGID=100 \
-e TZ=Australia/Sydney \
-v /share/appdata/syslog-ng/logs:/var/log \
-v /share/appdata/syslog-ng/conf:/etc/syslog-ng \
-l diun.enable=true \
--restart=unless-stopped \
--net customnetwork \
--ip 172.18.0.10 \
balabit/syslog-ng

The --cap-add options were needed to give the correct permissions and stop the "Error setting capabilities, capability management disabled; error='Operation not permitted" message in the syslog-ng logs when started.

You also need to edit /etc/logrotate.d/syslog-ng and change this:

invoke-rc.d syslog-ng reload > /dev/null

to this:

syslog-ng-ctl reload > /dev/null

in two places.

Hope this helps someone.