The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Bigger log files in /var/log

Discussion in 'General Discussion' started by postcd, Mar 22, 2015.

  1. postcd

    postcd Well-Known Member

    Joined:
    Oct 22, 2010
    Messages:
    619
    Likes Received:
    6
    Trophy Points:
    18
    Hello,

    i thought that during WHM setup i set some log rotating treshold to be like 350 Mb,

    but im unsure where is that setting in WHM?

    I see in /var/log i have some larger files:
    -rw------- 1 root root 3.1G Mar 22 22:11 messages
    -rw-r----- 1 mailnull mail 500M Mar 22 22:10 exim_mainlog
    -rw------- 1 root root 464M Mar 22 22:10 lfd.log

    Its probably too large? how can i please set better log rotation from WHM? Thank you
     
  2. dalem

    dalem Well-Known Member
    PartnerNOC

    Joined:
    Oct 24, 2003
    Messages:
    2,577
    Likes Received:
    40
    Trophy Points:
    48
    Location:
    SLC
    cPanel Access Level:
    DataCenter Provider
    Centos handles the rotation of the logs in /var/log

    check that they are configured to rotate in /etc/logrotate.d
    and
    set to run in /etc/logrotate.conf
    and the cron is there and the permissions are correct
    ls -l /etc/cron.daily/
     
  3. 24x7ss

    24x7ss Well-Known Member

    Joined:
    Sep 30, 2014
    Messages:
    271
    Likes Received:
    16
    Trophy Points:
    18
    Location:
    India
    cPanel Access Level:
    Root Administrator
    Twitter:
    You can set cpanel log rotation using below steps:

    Home » Service Configuration » cPanel Log Rotation Configuration.

    Please note that the files which are defined in the above path gets rotated on regular intervals.

    If you want to modify log roation policies as per your requirement then you have to set rules in /etc/logrotate.conf
     
  4. postcd

    postcd Well-Known Member

    Joined:
    Oct 22, 2010
    Messages:
    619
    Likes Received:
    6
    Trophy Points:
    18
    This path influences Files from /usr/local/cpanel/logs

    /etc/logrotate.d/ contains files: apf exim fail2ban lfd mysql named samba syslog yum
    /etc/logrotate.d/syslog is only one that contains "messages" in it. Its content is:

    Code:
    /var/log/cron
    /var/log/maillog
    /var/log/messages
    /var/log/secure
    /var/log/spooler
    {
        sharedscripts
        postrotate
            /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
        endscript
    }
    part of exim file:
    Code:
    /var/log/exim_mainlog {
        create 0640 mailnull mail
        compress
        postrotate
        /usr/bin/killall -HUP exim
        endscript
    }
    in /etc/logrotate.conf i have this part of code:
    Code:
    # rotate log files weekly
    weekly
    
    # keep 4 weeks worth of backlogs
    rotate 4
    # find /var/log -iname messages
    Code:
    /var/log/messages
    First log entry in /var/log/messages is: Nov 2 03:02:03

    Anyone would suggest any modiffication please?
     
  5. postcd

    postcd Well-Known Member

    Joined:
    Oct 22, 2010
    Messages:
    619
    Likes Received:
    6
    Trophy Points:
    18
    When i executed "# logrotate /etc/logrotate.d/syslog"
    messages file got created new empty, OK, but i want to ask how to discover why it is not rotated automaticaly?

    # cat /etc/cron.daily/logrotate
    Code:
    #!/bin/sh
    
    /usr/sbin/logrotate /etc/logrotate.conf >/dev/null 2>&1
    EXITVALUE=$?
    if [ $EXITVALUE != 0 ]; then
        /usr/bin/logger -t logrotate "ALERT exited abnormally with [$EXITVALUE]"
    fi
    exit 0
    -rwxr-xr-x 1 root root 196 Jul 18 2013 logrotate*
     
    #5 postcd, Mar 23, 2015
    Last edited: Mar 23, 2015
  6. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,675
    Likes Received:
    648
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    Hello,

    What's the full output when viewing your /etc/logrotate.conf file? Have you tried changing it from "weekly" to "daily" in this file?

    Thank you.
     
  7. postcd

    postcd Well-Known Member

    Joined:
    Oct 22, 2010
    Messages:
    619
    Likes Received:
    6
    Trophy Points:
    18
    thx, It is:
    Code:
    # see "man logrotate" for details
    # rotate log files weekly
    weekly
    
    # keep 4 weeks worth of backlogs
    rotate 4
    
    # create new (empty) log files after rotating old ones
    create
    
    # use date as a suffix of the rotated file
    dateext
    
    # uncomment this if you want your log files compressed
    #compress
    
    # RPM packages drop log rotation information into this directory
    include /etc/logrotate.d
    
    # no packages own wtmp and btmp -- we'll rotate them here
    /var/log/wtmp {
        monthly
        create 0664 root utmp
            minsize 1M
        rotate 1
    }
    
    /var/log/btmp {
        missingok
        monthly
        create 0600 root utmp
        rotate 1
    }
    
    # system-specific logs may be also be configured here.
    i didnt tried to change this file...
     
  8. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,675
    Likes Received:
    648
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
  9. postcd

    postcd Well-Known Member

    Joined:
    Oct 22, 2010
    Messages:
    619
    Likes Received:
    6
    Trophy Points:
    18
    I reviewed that and added line:
    size 200M
    to file /etc/logrotate.conf
    (that file contents i pasted in my previous message in this topic)

    i added it before end of the month and today around 2 days after new month i see in /var/log:
    -rw------- 1 root root 1.6G Jul 2 20:09 messages
    -rw-r----- 1 mailnull mail 1.1G Jul 2 20:08 exim_mainlog
    -rw------- 1 root root 712M Jul 2 20:08 lfd.log

    # head messages
    shows "Mar 23 10:27:11" entries..

    so that logs not decreased in size :(
    ??
     
  10. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,675
    Likes Received:
    648
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
  11. postcd

    postcd Well-Known Member

    Joined:
    Oct 22, 2010
    Messages:
    619
    Likes Received:
    6
    Trophy Points:
    18
    Thank you, here it is:
     
  12. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,675
    Likes Received:
    648
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    I don't see any issues with the configuration files that you posted. You may want to backup your logrotate configuration files and reinstall the "logrotate" package through YUM or manually via the RPM to see if that helps.

    Thank you.
     
  13. postcd

    postcd Well-Known Member

    Joined:
    Oct 22, 2010
    Messages:
    619
    Likes Received:
    6
    Trophy Points:
    18
    thx, im not sure which all config. files i have to backup so i tried to edit root crontab adding:

    Code:
    
    0 0 27 */2 * /usr/sbin/logrotate /etc/logrotate.d/syslog;/usr/sbin/logrotate /etc/logrotate.d/exim;/usr/sbin/logrotate /etc/logrotate.d/lfd
    
    
    to rotate the biggest files every 2 months hopefully.
     
    #13 postcd, Aug 29, 2015
    Last edited by a moderator: Sep 27, 2015
  14. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,675
    Likes Received:
    648
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    The logrotate configuration files are found in:

    /etc/logrotate.d/

    In addition, you should backup /etc/logrotate.conf and /etc/cron.daily/logrotate, assuming you have any custom entries.

    Thank you.
     
Loading...

Share This Page