Running TheHive 4.0.1-1 it appears that application.log is no longer rotated.

[pitrh]

Running TheHive 4.0.1-1 it appears that application.log is no longer rotated.

No changes made to the supplied logback.xml

How do I enable and/or debug the issue?

Originally posted by @pitrh in #579 (comment)

[mphbig]

Hello, same issue here.

We implemented a workaround using rsyslog and logrotate.

/etc/thehive/logback.xml

<?xml version="1.0" encoding="UTF-8"?>
<configuration debug="false">
    <conversionRule conversionWord="coloredLevel"
        converterClass="play.api.libs.logback.ColoredLevel"/>

    <appender name="SYSLOG" class="ch.qos.logback.classic.net.SyslogAppender">
        <syslogHost>localhost</syslogHost>
        <facility>LOCAL4</facility>
        <throwableExcluded>true</throwableExcluded>
        <suffixPattern>[%level] from %logger in %thread [%X{request}|%X{tx}] %message%n%xException</suffixPattern>
    </appender>

    <appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
        <encoder>
            <pattern>%coloredLevel %logger{15} [%X{request}|%X{tx}] %message%n%xException{10}</pattern>
        </encoder>
    </appender>

    <appender name="ASYNCSTDOUT" class="ch.qos.logback.classic.AsyncAppender">
        <appender-ref ref="STDOUT"/>
    </appender>

    <logger name="org.thp" level="INFO"/>

    <root level="INFO">
        <appender-ref ref="SYSLOG"/>
        <appender-ref ref="ASYNCSTDOUT"/>
    </root>

</configuration>

/etc/rsyslog.conf

$ModLoad imudp
$UDPServerAddress 127.0.0.1
$UDPServerRun 514

/etc/rsyslog.d/40-thehive.conf

local4.*        -/var/log/thehive/application.log

/etc/logrotate.d/thehive

/var/log/thehive/application.log
{
        rotate 20
        daily
        maxsize 250M
        compress
        nodelaycompress
        missingok
        notifempty
        create 660 root thehive
        postrotate
                invoke-rc.d rsyslog rotate > /dev/null
        endscript
}

[To-om]

@pitrh which package do you use (deb, rpm, zip, ...) ? Can you check if logback configuration file is used by TheHive (with the parameter -Dlogger.file=/etc/thehive/logback.xml) ?

[To-om]

I found a typo in logback.xml file. This is probably why logs are not rotated.

[pitrh]

The package was the then-latest rpm --
$ sudo yum list installed | grep -i thehive
cortex.noarch 3.1.0-1 @TheHive-Project
thehive4.noarch 4.0.4-1 @TheHive-Project

Applying the changes indicated in the referenced commit followed by "sudo systemctl restart thehive" did get log rotation going.

Please see my comment on the commit, the local (untouched) logback-migration.xml differed from the "before" version referenced in the commit.