Bigger log files in /var/log

postcd

Well-Known Member
Oct 22, 2010
721
21
68
Hello,

i thought that during WHM setup i set some log rotating treshold to be like 350 Mb,

but im unsure where is that setting in WHM?

I see in /var/log i have some larger files:
-rw------- 1 root root 3.1G Mar 22 22:11 messages
-rw-r----- 1 mailnull mail 500M Mar 22 22:10 exim_mainlog
-rw------- 1 root root 464M Mar 22 22:10 lfd.log

Its probably too large? how can i please set better log rotation from WHM? Thank you
 

dalem

Well-Known Member
PartnerNOC
Oct 24, 2003
2,983
159
368
SLC
cPanel Access Level
DataCenter Provider
Centos handles the rotation of the logs in /var/log

check that they are configured to rotate in /etc/logrotate.d
and
set to run in /etc/logrotate.conf
and the cron is there and the permissions are correct
ls -l /etc/cron.daily/
 

24x7ss

Well-Known Member
Sep 30, 2014
272
19
68
India
cPanel Access Level
Root Administrator
Twitter
You can set cpanel log rotation using below steps:

Home » Service Configuration » cPanel Log Rotation Configuration.

Please note that the files which are defined in the above path gets rotated on regular intervals.

If you want to modify log roation policies as per your requirement then you have to set rules in /etc/logrotate.conf
 

postcd

Well-Known Member
Oct 22, 2010
721
21
68
Home » Service Configuration » cPanel Log Rotation Configuration.
This path influences Files from /usr/local/cpanel/logs

/etc/logrotate.d/ contains files: apf exim fail2ban lfd mysql named samba syslog yum
/etc/logrotate.d/syslog is only one that contains "messages" in it. Its content is:

Code:
/var/log/cron
/var/log/maillog
/var/log/messages
/var/log/secure
/var/log/spooler
{
    sharedscripts
    postrotate
        /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
    endscript
}
part of exim file:
Code:
/var/log/exim_mainlog {
    create 0640 mailnull mail
    compress
    postrotate
    /usr/bin/killall -HUP exim
    endscript
}
in /etc/logrotate.conf i have this part of code:
Code:
# rotate log files weekly
weekly

# keep 4 weeks worth of backlogs
rotate 4
# find /var/log -iname messages
Code:
/var/log/messages
First log entry in /var/log/messages is: Nov 2 03:02:03

Anyone would suggest any modiffication please?
 

postcd

Well-Known Member
Oct 22, 2010
721
21
68
When i executed "# logrotate /etc/logrotate.d/syslog"
messages file got created new empty, OK, but i want to ask how to discover why it is not rotated automaticaly?

# cat /etc/cron.daily/logrotate
Code:
#!/bin/sh

/usr/sbin/logrotate /etc/logrotate.conf >/dev/null 2>&1
EXITVALUE=$?
if [ $EXITVALUE != 0 ]; then
    /usr/bin/logger -t logrotate "ALERT exited abnormally with [$EXITVALUE]"
fi
exit 0
-rwxr-xr-x 1 root root 196 Jul 18 2013 logrotate*
 
Last edited:

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,884
2,250
463
When i executed "# logrotate /etc/logrotate.d/syslog"
messages file got created new empty, OK, but i want to ask how to discover why it is not rotated automaticaly?
Hello,

What's the full output when viewing your /etc/logrotate.conf file? Have you tried changing it from "weekly" to "daily" in this file?

Thank you.
 

postcd

Well-Known Member
Oct 22, 2010
721
21
68
What's the full output when viewing your /etc/logrotate.conf file?
thx, It is:
Code:
# see "man logrotate" for details
# rotate log files weekly
weekly

# keep 4 weeks worth of backlogs
rotate 4

# create new (empty) log files after rotating old ones
create

# use date as a suffix of the rotated file
dateext

# uncomment this if you want your log files compressed
#compress

# RPM packages drop log rotation information into this directory
include /etc/logrotate.d

# no packages own wtmp and btmp -- we'll rotate them here
/var/log/wtmp {
    monthly
    create 0664 root utmp
        minsize 1M
    rotate 1
}

/var/log/btmp {
    missingok
    monthly
    create 0600 root utmp
    rotate 1
}

# system-specific logs may be also be configured here.
i didnt tried to change this file...
 

postcd

Well-Known Member
Oct 22, 2010
721
21
68
review the following third-party URL regarding file size limits:
http://stackoverflow.com/questions/...g-logrotate-to-maximum-file-size-for-all-logs
I reviewed that and added line:
size 200M
to file /etc/logrotate.conf
(that file contents i pasted in my previous message in this topic)

i added it before end of the month and today around 2 days after new month i see in /var/log:
-rw------- 1 root root 1.6G Jul 2 20:09 messages
-rw-r----- 1 mailnull mail 1.1G Jul 2 20:08 exim_mainlog
-rw------- 1 root root 712M Jul 2 20:08 lfd.log

# head messages
shows "Mar 23 10:27:11" entries..

so that logs not decreased in size :(
??
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,884
2,250
463
Please post the contents of the /etc/logrotate.d/syslog file.

Thank you.
 

postcd

Well-Known Member
Oct 22, 2010
721
21
68
Please post the contents of the /etc/logrotate.d/syslog file.
Thank you, here it is:
# cat /etc/logrotate.d/syslog
/var/log/cron
/var/log/maillog
/var/log/messages
/var/log/secure
/var/log/spooler
{
# rotate 0
# weekly
sharedscripts
postrotate
/bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
endscript
}
 

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,884
2,250
463
I don't see any issues with the configuration files that you posted. You may want to backup your logrotate configuration files and reinstall the "logrotate" package through YUM or manually via the RPM to see if that helps.

Thank you.
 

postcd

Well-Known Member
Oct 22, 2010
721
21
68
thx, im not sure which all config. files i have to backup so i tried to edit root crontab adding:

Code:
0 0 27 */2 * /usr/sbin/logrotate /etc/logrotate.d/syslog;/usr/sbin/logrotate /etc/logrotate.d/exim;/usr/sbin/logrotate /etc/logrotate.d/lfd
to rotate the biggest files every 2 months hopefully.
 
Last edited by a moderator:

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,884
2,250
463
The logrotate configuration files are found in:

/etc/logrotate.d/

In addition, you should backup /etc/logrotate.conf and /etc/cron.daily/logrotate, assuming you have any custom entries.

Thank you.