NGINX has to be restarted after sys internal log rotation feature

Hello,

I have noticed that if you use the build-in log rotation of Linux

Reference:

[akama.aka@dc-eu-ger-fra-001 ~]$ cat /etc/logrotate.conf 
# see "man logrotate" for details

# global options do not affect preceding include directives

# rotate log files weekly
weekly

# keep 4 weeks worth of backlogs
rotate 4

# create new (empty) log files after rotating old ones
create

# use date as a suffix of the rotated file
dateext

# uncomment this if you want your log files compressed
#compress

# packages drop log rotation information into this directory
include /etc/logrotate.d

# system-specific logs may be also be configured here.


/var/log/modsec_audit.log {
	compress
	daily
	missingok
	rotate 366
}

that the nginx server must be restarted so that it continues to be logged into the /var/log/modsec_audit.log file. Otherwise everything remains empty and it is written to the nginx own error log file.

I've created a crontab that restarts the nginx Server one minute after 12am.

Begin by reproducing rotation with /etc/logrotate.conf and /var/log/modsec_audit.log, then trace how the NGINX connector handles the rotated file and error-log fallback. Done means log rotation continues writing audit entries to the expected file without the reported restart workaround; no test file is named in the issue.