ModSecurity-nginx icon indicating copy to clipboard operation
ModSecurity-nginx copied to clipboard

NGINX has to be restarted after sys internal log rotation feature

Open akama-aka opened this issue 10 months ago • 2 comments

Hello,

I have noticed that if you use the build-in log rotation of Linux

Reference:

[akama.aka@dc-eu-ger-fra-001 ~]$ cat /etc/logrotate.conf 
# see "man logrotate" for details

# global options do not affect preceding include directives

# rotate log files weekly
weekly

# keep 4 weeks worth of backlogs
rotate 4

# create new (empty) log files after rotating old ones
create

# use date as a suffix of the rotated file
dateext

# uncomment this if you want your log files compressed
#compress

# packages drop log rotation information into this directory
include /etc/logrotate.d

# system-specific logs may be also be configured here.


/var/log/modsec_audit.log {
	compress
	daily
	missingok
	rotate 366
}

that the nginx server must be restarted so that it continues to be logged into the /var/log/modsec_audit.log file. Otherwise everything remains empty and it is written to the nginx own error log file.

I've created a crontab that restarts the nginx Server one minute after 12am.

akama-aka avatar Apr 18 '25 10:04 akama-aka

Hi @akama-aka,

thanks for reporting this. I marked this issue as duplicated, because there are some other similar issues.

Note, that there is a possible fix, see #198, but it seems like that's unfinished.

airween avatar Apr 18 '25 10:04 airween

Hi @akama-aka,

thanks for reporting this. I marked this issue as duplicated, because there are some other similar issues.

Note, that there is a possible fix, see #198, but it seems like that's unfinished.

Oh okay sorry o.o. thank you for letting me know. ;3

akama-aka avatar Apr 18 '25 10:04 akama-aka