- What I did

• Enhance the robustness of logrotate

- How I did it

• Prevent multiple hung logrotate processes from accumulating and consuming CPU/memory
  • Decrease frequency of cron job which runs logrotate from every 1 minute to every 10 minutes
  • In cron job, before running logrotate, kill any lingering logrotate processes, as they are most likely hung
• Add step to prerotate script to delete all *.1.gz files which, if they are present, means they were left over from a prior, incomplete run of logrotate. If any of these files exist, logrotate will fail to do its job for that log.
• Rename prerotate script to firstaction, as prerotate is run after logrotate renames existing scripts, which is too late to delete all *.1.gz files, as the renaming will fail and prerotate will never be run. firstaction runs before everything, so this is the appropriate script for all of this cleanup.
• Remove note about working around a bug in init-system-helpers < 1.47. Debian Stretch now has init-system-helpers version 1.48 installed, and while calling service rsyslog rotate no longer reports an error, it doesn't seem to cause rsyslogd to properly close the old file. Therefore, we will continue sending SIGHUP directly to the rsyslogd process and no longer consider it a workaround.

- How to verify it

1.) Simulate a left-behind *.1.gz file: touch /var/log/syslog.1.gz
2.) Fill syslog past the 1MB size threshold specified in the block
3.) Wait for 10 minutes (you can also tail /var/log/cron.log to watch for the next execution of logrotate), then check to ensure /var/log/syslog.1.gz is no longer present and that syslog has been rotated.
4.) Repeat with the other log files specified in this section