🤔 Failed to kill unit rsyslog.service: Input/output error

[Dinghy]

Hello,
I receive daily an email from Cron:

/etc/cron.daily/logrotate:
Failed to kill unit rsyslog.service: Input/output error
error: error running non-shared postrotate script for /var/log/syslog of '/var/log/syslog'
run-parts: /etc/cron.daily/logrotate exited with return code 1

I have seen other forum posts on similar problems, e.g. Logrotate error, but these errors are different.

So I tried to trace the error:
/etc/cron.daily/logrotate ends by calling /usr/sbin/logrotate /etc/logrotate.conf
/etc/logrotate.conf has include /etc/logrotate.d
which calls, among others /etc/logrotate.d/rsyslog
in which you find

    postrotate
            /usr/lib/rsyslog/rsyslog-rotate
    endscript

(I manually restarted rsyslog to see if that worked, it did, and then ran:)
$ sudo /usr/lib/rsyslog/rsyslog-rotate returns with
Failed to kill unit rsyslog.service: Input/output error
So that is where the error happens.

$ sudo service rsyslog status shows

Failed to dump process list, ignoring: Input/output error
* rsyslog.service - System Logging Service
   Loaded: loaded (/lib/systemd/system/rsyslog.service; enabled; vendor preset: enabled)
   Active: active (running) since Wed 2019-05-08 10:15:22 UTC; 20s ago
     Docs: man:rsyslogd(8)
           http://www.rsyslog.com/doc/
 Main PID: 8367 (rsyslogd)
    Tasks: 4 (limit: 4915)
   CGroup: /system.slice/rsyslog.service

May 08 10:15:22 staging systemd[1]: Starting System Logging Service...
May 08 10:15:22 staging systemd[8367]: Failed to attach 8367 to compat systemd cgroup /system.slice/rsyslog.service: No such file or directory
May 08 10:15:22 staging rsyslogd[8367]: imuxsock: Acquired UNIX socket '/run/systemd/journal/syslog' (fd 3) from systemd.  [v8.32.0]
May 08 10:15:22 staging rsyslogd[8367]: rsyslogd's groupid changed to 102
May 08 10:15:22 staging systemd[1]: Started System Logging Service.
May 08 10:15:22 staging rsyslogd[8367]: rsyslogd's userid changed to 100
May 08 10:15:22 staging rsyslogd[8367]:  [origin software="rsyslogd" swVersion="8.32.0" x-pid="8367" x-info="http://www.rsyslog.com"] start
May 08 10:15:36 staging rsyslogd[8367]:  [origin software="rsyslogd" swVersion="8.32.0" x-pid="8367" x-info="http://www.rsyslog.com"] rsyslogd was HUPed

So, why do I get Failed to dump process list, ignoring: Input/output error? Where can I look for more messages?

Thanks!

[Dinghy]

About once a week, I also receive this error (both on staging and production):

/etc/cron.daily/logrotate:
Failed to kill unit rsyslog.service: Input/output error
error: error running non-shared postrotate script for /var/log/syslog of '/var/log/syslog'
Failed to kill unit rsyslog.service: Input/output error
error: error running shared postrotate script for '/var/log/mail.info
/var/log/mail.warn
/var/log/mail.err
/var/log/mail.log
/var/log/daemon.log
/var/log/kern.log
/var/log/auth.log
/var/log/user.log
/var/log/lpr.log
/var/log/cron.log
/var/log/debug
/var/log/messages'
 * Re-opening nginx log files nginx
   ...done.
run-parts: /etc/cron.daily/logrotate exited with return code 1

Do you have ideas what I could look into?

[Dinghy]

$ sudo logrotate -v /etc/logrotate.d/rsyslog gives more information

...
considering log /var/log/syslog
error: skipping "/var/log/syslog" because parent directory has insecure permissions (It's world writable or writable by group which is not "root") Set "su" directive in config file to tell logrotate which user/group should be used for rotation.

Now this is sound info.
$ ll /var/log

drwxrwxr-x   9 root   syslog             4096 May 13 06:21 ./
drwxr-xr-x  12 root   root               4096 Dec 27 11:58 ../

Is this only the case on my machines or also on a fresh provision?
Fixed . to drwxr-xr-x, let’s see tomorrow…

[Dinghy]

@Dinghy

Fixed . to drwxr-xr-x

Did not solve the issue: I still receive the error described above

[Dinghy]

Does nobody have an idea what I could look into / try out?