ufw logrotate broken

[Bib]

ubuntu 14.04.3 with all updates done.
This morning I enabled ufw full login for a while to track network problem. Later I got warned /var is nearly full. I disabled login then found 3 huge ufw.log kern.log & syslog files 1.2GB each. Wanting to logrotate to make room nothing happens with sudo logrotate /etc/logrotate.conf nor sudo /etc/cron.daily/logrotate although I can see some logs were rotated during past night.
I have seen messages about permissions I can't remember where.

ls -ld /var/log
drwxrwxr-x 14 root syslog 4096 janv. 4 07:44 /var/log

ls -l /var/log/kern*
-rw-r----- 1 syslog adm 1229901824 janv. 4 13:36 /var/log/kern.log
-rw-r----- 1 syslog adm 13373 janv. 4 07:44 /var/log/kern.log.1
-rw-r----- 1 syslog adm 509 déc 27 08:04 /var/log/kern.log.2.gz
-rw-r----- 1 syslog adm 152524 déc 21 07:41 /var/log/kern.log.3.gz
-rw-r----- 1 syslog adm 521 déc 13 07:54 /var/log/kern.log.4.gz

ls -l /var/log/sysl*
-rw-r----- 1 syslog adm 1229910016 janv. 4 16:30 /var/log/syslog
-rw-r----- 1 syslog adm 11305 janv. 4 07:44 /var/log/syslog.1
-rw-r----- 1 syslog adm 748 janv. 3 07:42 /var/log/syslog.2.gz
-rw-r----- 1 syslog adm 692 janv. 2 07:37 /var/log/syslog.3.gz
-rw-r----- 1 syslog adm 719 janv. 1 07:58 /var/log/syslog.4.gz
-rw-r----- 1 syslog adm 691 déc 31 07:50 /var/log/syslog.5.gz
-rw-r----- 1 syslog adm 1504 déc 30 07:38 /var/log/syslog.6.gz
-rw-r----- 1 syslog adm 697 déc 29 08:05 /var/log/syslog.7.gz

ls -l /var/log/ufw*
-rw-r----- 1 syslog adm 1229922304 janv. 4 11:38 /var/log/ufw.log
-rw-r----- 1 syslog adm 5447 janv. 4 00:17 /var/log/ufw.log.1
-rw-r----- 1 syslog adm 380 août 15:29 /var/log/ufw.log.2.gz

cat /etc/logrotate.conf
# see "man logrotate" for details
# rotate log files weekly
weekly

# use the syslog group by default, since this is the owning group
# of /var/log/syslog.
su root syslog

# keep 4 weeks worth of backlogs
rotate 4

# create new (empty) log files after rotating old ones
create

# uncomment this if you want your log files compressed
#compress

# packages drop log rotation information into this directory
include /etc/logrotate.d

# no packages own wtmp, or btmp -- we'll rotate them here
/var/log/wtmp {
    missingok
    monthly
    create 0664 root utmp
    rotate 1
}

/var/log/btmp {
    missingok
    monthly
    create 0660 root utmp
    rotate 1
}

# system-specific logs may be configured here

cat /etc/logrotate.d/ufw
/var/log/ufw.log
{
 rotate 4
 weekly
 missingok
 notifempty
 compress
 delaycompress
 sharedscripts
 postrotate
  invoke-rc.d rsyslog reload >/dev/null 2>&1 || true
 endscript
}

cat /etc/cron.daily/logrotate
#!/bin/sh

# Clean non existent log file entries from status file
cd /var/lib/logrotate
test -e status || touch status
head -1 status > status.clean
sed 's/"//g' status | while read logfile date
do
    [ -e "$logfile" ] && echo "\"$logfile\" $date"
done >> status.clean
mv status.clean status

test -x /usr/sbin/logrotate || exit 0
/usr/sbin/logrotate /etc/logrotate.conf

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Alex Haydock (alexhaydock)]

This is still an issue in Focal (20.04).

I think it is because the "postrotate" line of the default /etc/logrotate.d/ufw file reads:

```
invoke-rc.d rsyslog rotate >/dev/null 2>&1 || true
```

Which will not function on a systemd system.

Using the example from /etc/logrotate.d/rsyslog would work far better. It simply reads:

```
/usr/lib/rsyslog/rsyslog-rotate
```

This runs a shell script shipped with rsyslog which will use systemctl to issue a HUP when rotating on a systemd system, and the old invoke-rc.d method on a system without systemd.