Rsyslog stops reading logs after log rotate

[Stiggyman]

The issue I am facing:
Running pihole i want the logs in a SIEM system ( Graylog ) and i found that Rsyslog had a relatively easy config file to setup to read from Pihole.

My issue is that once the pihole around midnight log rotates Rsyslog loses the file and needs a full apt-get remove and apt-get install before it starts reading again.. restarting the service is not enough.

Details about my system:

the Pihole is setup pretty bare bones it reads some lists from github to update gravity and thats about it

running on ubuntu 22.04

my rsyslog config here

 # /etc/rsyslog.conf configuration file for rsyslog

#

# For more information install rsyslog-doc and see

# /usr/share/doc/rsyslog-doc/html/configuration/index.html

#

# Default logging rules can be found in /etc/rsyslog.d/50-default.conf

#################

#### MODULES ####

#################

module(load="imuxsock") # provides support for local system logging

#module(load="immark") # provides --MARK-- message capability

# provides UDP syslog reception

#module(load="imudp")

#input(type="imudp" port="514")

# provides TCP syslog reception

#module(load="imtcp")

#input(type="imtcp" port="514")

# provides kernel logging support and enable non-kernel klog messages

module(load="imklog" permitnonkernelfacility="on")

###########################

#### GLOBAL DIRECTIVES ####

###########################

#

# Use traditional timestamp format.

# To enable high precision timestamps, comment out the following line.

#

$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat

# Filter duplicated messages

$RepeatedMsgReduction on

#

# Set the default permissions for all log files.

#

$FileOwner syslog

$FileGroup adm

$FileCreateMode 0640

$DirCreateMode 0755

$Umask 0022

$PrivDropToUser syslog

$PrivDropToGroup adm

#

# Where to place spool and state files

#

$WorkDirectory /var/spool/rsyslog

#

# Include all config files in /etc/rsyslog.d/

#

$IncludeConfig /etc/rsyslog.d/*.conf 

and my 22-graylog.conf here

 # Forward all logs to graylog:

*.* action(type="omfwd" target="XXXXXXXX" protocol="tcp"

action.resumeRetryCount="100"

queue.type="linkedList" queue.size="10000")

# Define extra log sources:

module(load="imfile" PollingInterval="30")

input(type="imfile" File="/var/log/pihole.log"

Tag="pihole"

StateFile="/var/spool/rsyslog/piholestate1"

Severity="notice"

Facility="local1")

input(type="imfile" File="/var/log/pihole-FTL.log"

Tag="piFTL"

StateFile="/var/spool/rsyslog/piFTLstate1"

Severity="notice"

Facility="local1") 

have anyone got a clue how i can get this working for longer than 24 hours?

What I have changed since installing Pi-hole:

Not applicable other than installing Rsyslog its bare bones Ubuntu 22.04 server with pihole setup

[CallMeCurious]

I'm not familiar with how your doing this but I do not believe that pihole rotates the logs. I believe this would be a logrotate function. Perhaps you need to add a specific config in /etc/logrotate.d?

I also found this old thread. It was never responded to / resolved but might provide some additional insight.

Logrotate and rsyslog

I'm running two instances of pihole in my environment, one on a RPi4 and the other in docker on a Synology DS1019+. I want to forward logs from both instances to a central graylog server (also running in Synology docker). When I first set this up on the Pi, it worked fine but, on logrotate at midnight, rsyslog stopped forwarding entries from pihole.log. It seems that pihole logrotate is implemented by performing a copy and then truncate rather than a move. I see from reading in /opt/pihole/piho…

[rdwebdesign]

Log are rotated by logrotate, as CallMeCurious said.

advanced/Templates/logrotate