Bigger log files in /var/log

[postcd]

Hello,

i thought that during WHM setup i set some log rotating treshold to be like 350 Mb,

but im unsure where is that setting in WHM?

I see in /var/log i have some larger files:
-rw------- 1 root root 3.1G Mar 22 22:11 messages
-rw-r----- 1 mailnull mail 500M Mar 22 22:10 exim_mainlog
-rw------- 1 root root 464M Mar 22 22:10 lfd.log

Its probably too large? how can i please set better log rotation from WHM? Thank you

 

[dalem]

Centos handles the rotation of the logs in /var/log

check that they are configured to rotate in /etc/logrotate.d
and
set to run in /etc/logrotate.conf
and the cron is there and the permissions are correct
ls -l /etc/cron.daily/

 

[24x7ss]

You can set cpanel log rotation using below steps:

Home » Service Configuration » cPanel Log Rotation Configuration.

Please note that the files which are defined in the above path gets rotated on regular intervals.

If you want to modify log roation policies as per your requirement then you have to set rules in /etc/logrotate.conf

 

[postcd]

Home » Service Configuration » cPanel Log Rotation Configuration.

This path influences Files from /usr/local/cpanel/logs

/etc/logrotate.d/ contains files: apf exim fail2ban lfd mysql named samba syslog yum
/etc/logrotate.d/syslog is only one that contains "messages" in it. Its content is:

/var/log/cron
/var/log/maillog
/var/log/messages
/var/log/secure
/var/log/spooler
{
    sharedscripts
    postrotate
        /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
    endscript
}

part of exim file:

/var/log/exim_mainlog {
    create 0640 mailnull mail
    compress
    postrotate
    /usr/bin/killall -HUP exim
    endscript
}

in /etc/logrotate.conf i have this part of code:

# rotate log files weekly
weekly

# keep 4 weeks worth of backlogs
rotate 4

# find /var/log -iname messages

/var/log/messages

First log entry in /var/log/messages is: Nov 2 03:02:03

Anyone would suggest any modiffication please?

 

[postcd]

When i executed "# logrotate /etc/logrotate.d/syslog"
messages file got created new empty, OK, but i want to ask how to discover why it is not rotated automaticaly?

# cat /etc/cron.daily/logrotate

#!/bin/sh

/usr/sbin/logrotate /etc/logrotate.conf >/dev/null 2>&1
EXITVALUE=$?
if [ $EXITVALUE != 0 ]; then
    /usr/bin/logger -t logrotate "ALERT exited abnormally with [$EXITVALUE]"
fi
exit 0

-rwxr-xr-x 1 root root 196 Jul 18 2013 logrotate*

 

[cPanelMichael]

When i executed "# logrotate /etc/logrotate.d/syslog"
messages file got created new empty, OK, but i want to ask how to discover why it is not rotated automaticaly?

Hello,

What's the full output when viewing your /etc/logrotate.conf file? Have you tried changing it from "weekly" to "daily" in this file?

Thank you.

 

[postcd]

What's the full output when viewing your /etc/logrotate.conf file?

thx, It is:

# see "man logrotate" for details
# rotate log files weekly
weekly

# keep 4 weeks worth of backlogs
rotate 4

# create new (empty) log files after rotating old ones
create

# use date as a suffix of the rotated file
dateext

# uncomment this if you want your log files compressed
#compress

# RPM packages drop log rotation information into this directory
include /etc/logrotate.d

# no packages own wtmp and btmp -- we'll rotate them here
/var/log/wtmp {
    monthly
    create 0664 root utmp
        minsize 1M
    rotate 1
}

/var/log/btmp {
    missingok
    monthly
    create 0600 root utmp
    rotate 1
}

# system-specific logs may be also be configured here.

i didnt tried to change this file...

 

[cPanelMichael]

You can change "weekly" to "daily" and review the following third-party URL regarding file size limits:

http://stackoverflow.com/questions/...g-logrotate-to-maximum-file-size-for-all-logs

Thank you.

 

[postcd]

review the following third-party URL regarding file size limits:
http://stackoverflow.com/questions/...g-logrotate-to-maximum-file-size-for-all-logs

I reviewed that and added line:
size 200M
to file /etc/logrotate.conf
(that file contents i pasted in my previous message in this topic)

i added it before end of the month and today around 2 days after new month i see in /var/log:
-rw------- 1 root root 1.6G Jul 2 20:09 messages
-rw-r----- 1 mailnull mail 1.1G Jul 2 20:08 exim_mainlog
-rw------- 1 root root 712M Jul 2 20:08 lfd.log

# head messages
shows "Mar 23 10:27:11" entries..

so that logs not decreased in size
??

 

[cPanelMichael]

Please post the contents of the /etc/logrotate.d/syslog file.

Thank you.

 

[postcd]

Please post the contents of the /etc/logrotate.d/syslog file.

Thank you, here it is:

# cat /etc/logrotate.d/syslog
/var/log/cron
/var/log/maillog
/var/log/messages
/var/log/secure
/var/log/spooler
{
# rotate 0
# weekly
sharedscripts
postrotate
/bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
endscript
}

 

[cPanelMichael]

I don't see any issues with the configuration files that you posted. You may want to backup your logrotate configuration files and reinstall the "logrotate" package through YUM or manually via the RPM to see if that helps.

Thank you.

 

[postcd]

thx, im not sure which all config. files i have to backup so i tried to edit root crontab adding:

0 0 27 */2 * /usr/sbin/logrotate /etc/logrotate.d/syslog;/usr/sbin/logrotate /etc/logrotate.d/exim;/usr/sbin/logrotate /etc/logrotate.d/lfd

to rotate the biggest files every 2 months hopefully.

 

[cPanelMichael]

The logrotate configuration files are found in:

/etc/logrotate.d/

In addition, you should backup /etc/logrotate.conf and /etc/cron.daily/logrotate, assuming you have any custom entries.

Thank you.