My question today is about the art of troubleshooting with the topic of logrotate and journalctl. I'm interested in learning how to debug and troubleshoot my logrotate and journal configuration.
The specific problem is this:
After reboot the logs of the last two days are missing and the logs reported by journalctl begin just at the last boot time. When having a look at /var/log I can see that logrotate created two compressed log files as expected, but they end two days ago, while the latest log begins at the last reboot which leaves us with two missing days of log data, since the machine restart just now.
So my specific question is, why do these logs get missing on reboot?
And my general question, because this is kind of tricky with all the specifics of my setup and configurations, I'd like to know how to tackle such a problem and where to start troubleshooting.
logrotate btw. is configured to run twice a day with
rotate 2
weekly
maxsize 2M
missingok
notifempty
delaycompress
compress
postrotate
invoke-rc.d rsyslog rotate > /dev/null
