I've problems with /var/log/maillog, i can't see why the /var/log/maillog is empty and it keeps logging into a /var/log/maillog-$(last time of rotate) file?
It messes up my CSF and LFD detection rules!
[root@mail ~]# ll /var/log/maillog*
-rw------- 1 root root 0 Jul 26 03:44 /var/log/maillog
-rw------- 1 root root 2583438 Jul 26 19:06 /var/log/maillog-20150726
[root@mail ~]#
The same happens for all the other logs controlled by rsyslog:
[root@mail ~]# ll /var/log/cron*
-rw------- 1 root root 0 Jul 26 03:44 /var/log/cron
-rw------- 1 root root 1055186 Jul 25 20:01 /var/log/cron-20150705
-rw------- 1 root root 39127 Jul 26 19:05 /var/log/cron-20150726
[root@mail ~]#
[root@mail ~]# ll /var/log/messages*
-rw------- 1 root root 0 Jul 26 03:44 /var/log/messages
-rw------- 1 root root 163615380 Jul 25 20:04 /var/log/messages-20150705
-rw------- 1 root root 4223441 Jul 26 19:08 /var/log/messages-20150726
[root@mail ~]#
Any idea how to fix this?
Is the following commented lines causing the problem?
[root@mail ~]# cat /etc/logrotate.d/syslog
/var/log/cron
/var/log/maillog
/var/log/messages
/var/log/secure
/var/log/spooler
{
# sharedscripts
# postrotate
# /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
# endscript
}
[root@mail ~]#