Problem with logrotate: Log rotation writes to incorrect file

Problem Description:

After configuring logrotate to handle ModSecurity log rotation, I encountered an unexpected issue. After the first rotation, logs are being written to the file modsec_audit.log.1 instead of modsec_audit.log. Additionally, all subsequent logs are appended to the modsec_audit.log.1 file, leading to potentially large log files.

Logrotate Configuration:

/var/log/modsec_audit.log {
  daily
  rotate 14
  compress
  delaycompress
  missingok
  notifempty
  create 644 root root
  sharedscripts
  postrotate
    /usr/sbin/service nginx reopenlogs >/dev/null 2>&1 || true
  endscript
}

Steps to Reproduce the Issue:

1. ModSecurity configuration adhering to recommendations.
2. Logrotate configuration added in /etc/logrotate.d/modsec.

Expected Behavior:

Logs should be correctly rotated into the modsec_audit.log file with the proper rotation suffix.

Observed Behavior:
Logs are written to the modsec_audit.log.1 file after the first rotation, and subsequent logs are appended to the modsec_audit.log.1 file.

Environment:

Operating System: linux ubuntu 20.04
ModSecurity Version: V3
Logrotate Version: 3.14.0

Your assistance in addressing this matter and providing guidance or a fix would be greatly appreciated. Thank you!

Start by reproducing the reported behavior with the supplied /etc/logrotate.d/modsec configuration, ModSecurity V3, and nginx's reopenlogs command. Trace how the audit log is reopened after rotation; done means new entries continue in modsec_audit.log rather than modsec_audit.log.1.