Logs not rotating

[4u123]

Hi,

I just noticed the logs on a couple of servers go back to november 2007. Can anyone suggest what might be the problem - I dont know anything about logrotate, is this a linux thing or a cpanel thing ? I've searched this forum but couldnt find an answer.

 

[kernow]

Check this out; http://www.configserver.com/techfaq/faqlist.php?catid=6&faqid=38

 

[4u123]

Thanks Kernow but I already use that.

The exim_mainlog file on one server goes back to the 21st Oct.

syslog appears to be running ok. Any other ideas ?

 

[cPanelKenneth]

logrotate is in OS thing. There should be logrotate entries in /etc/cron.daily Also check entries in /etc/logrotate.d

If you have /var/log/cron, you can also check that to determine why the files are not being rotated properly.

 

[4u123]

Thanks Ken,

I've checked /etc/cron.daily and /etc/logrotate.d both seem fine. I have compared the files on a server that isnt rotating to one that is working correctly - they are identical.

I've grep'd the cron log for "logrotate" but it came back with nothing - I searched for "error" - nothing and "cron.daily = just a load of Updated timestamp entries. What should I be looking for ?

Is there a way to run a log rotate from the command line so I can see what its doing ?

 

[cPanelKenneth]

You can execute logrotate manually. Use the -d flag to get feedback on what it is doing.

[email protected] [~]# logrotate -d /etc/logrotate.conf 
reading config file /etc/logrotate.conf
including /etc/logrotate.d
reading config file acpid
reading config info for /var/log/acpid 
reading config file cups
reading config info for /var/log/cups/*_log 
reading config file exim
reading config info for /var/log/exim_mainlog 
reading config info for /var/log/exim_paniclog 
reading config info for /var/log/exim_rejectlog 
reading config file mgetty
reading config info for /var/log/mgetty.log.tty[^.] /var/log/mgetty.log.tty[^.][^.] /var/log/mgetty.log.tty[^.][^.][^.] /var/log/mgetty.log.tty[^.][^.][^.][^.] /var/log/mgetty.log.tty[^.][^.][^.][^.][^.] /var/log/mgetty.log.tty[^.][^.][^.][^.][^.][^.] /var/log/mgetty.log.tty[^.][^.][^.][^.][^.][^.][^.] /var/log/mgetty.log.tty[^.][^.][^.][^.][^.][^.][^.][^.] /var/log/mgetty.log.tty[^.][^.][^.][^.][^.][^.][^.][^.][^.] /var/log/mgetty.log.tty[^.][^.][^.][^.][^.][^.][^.][^.][^.][^.] /var/log/mgetty.log.unknown /var/log/mgetty.callback 
reading config file mysql
reading config info for /var/lib/mysql/mysqld.log 
reading config file named
reading config info for /var/log/named.log 
reading config file ppp
reading config info for /var/log/ppp/connect-errors 
reading config file psacct
reading config info for /var/account/pacct 
reading config file rpm
reading config info for /var/log/rpmpkgs 
reading config file syslog
reading config info for /var/log/messages /var/log/secure /var/log/maillog /var/log/spooler /var/log/boot.log /var/log/cron 
reading config file up2date
reading config info for /var/log/up2date 
reading config file yum
reading config info for /var/log/yum.log 
reading config info for /var/log/wtmp 

Handling 15 logs

rotating pattern: /var/log/acpid  65536 bytes (4 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/acpid
  log does not need rotating

rotating pattern: /var/log/cups/*_log  weekly (4 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/cups/error_log
  log does not need rotating
not running shared postrotate script, since no logs were rotated

rotating pattern: /var/log/exim_mainlog  weekly (4 rotations)
empty log files are rotated, old logs are removed
considering log /var/log/exim_mainlog
  log does not need rotating

rotating pattern: /var/log/exim_paniclog  weekly (4 rotations)
empty log files are rotated, old logs are removed
considering log /var/log/exim_paniclog
  log does not need rotating

rotating pattern: /var/log/exim_rejectlog  weekly (4 rotations)
empty log files are rotated, old logs are removed
considering log /var/log/exim_rejectlog
  log does not need rotating

rotating pattern: /var/log/mgetty.log.tty[^.] /var/log/mgetty.log.tty[^.][^.] /var/log/mgetty.log.tty[^.][^.][^.] /var/log/mgetty.log.tty[^.][^.][^.][^.] /var/log/mgetty.log.tty[^.][^.][^.][^.][^.] /var/log/mgetty.log.tty[^.][^.][^.][^.][^.][^.] /var/log/mgetty.log.tty[^.][^.][^.][^.][^.][^.][^.] /var/log/mgetty.log.tty[^.][^.][^.][^.][^.][^.][^.][^.] /var/log/mgetty.log.tty[^.][^.][^.][^.][^.][^.][^.][^.][^.] /var/log/mgetty.log.tty[^.][^.][^.][^.][^.][^.][^.][^.][^.][^.] /var/log/mgetty.log.unknown /var/log/mgetty.callback  weekly (4 rotations)
empty log files are rotated, old logs are removed
considering log /var/log/mgetty.log.tty[^.]
  log /var/log/mgetty.log.tty[^.] does not exist -- skipping
considering log /var/log/mgetty.log.tty[^.][^.]
  log /var/log/mgetty.log.tty[^.][^.] does not exist -- skipping
considering log /var/log/mgetty.log.tty[^.][^.][^.]
  log /var/log/mgetty.log.tty[^.][^.][^.] does not exist -- skipping
considering log /var/log/mgetty.log.tty[^.][^.][^.][^.]
  log /var/log/mgetty.log.tty[^.][^.][^.][^.] does not exist -- skipping
considering log /var/log/mgetty.log.tty[^.][^.][^.][^.][^.]
  log /var/log/mgetty.log.tty[^.][^.][^.][^.][^.] does not exist -- skipping
considering log /var/log/mgetty.log.tty[^.][^.][^.][^.][^.][^.]
  log /var/log/mgetty.log.tty[^.][^.][^.][^.][^.][^.] does not exist -- skipping
considering log /var/log/mgetty.log.tty[^.][^.][^.][^.][^.][^.][^.]
  log /var/log/mgetty.log.tty[^.][^.][^.][^.][^.][^.][^.] does not exist -- skipping
considering log /var/log/mgetty.log.tty[^.][^.][^.][^.][^.][^.][^.][^.]
  log /var/log/mgetty.log.tty[^.][^.][^.][^.][^.][^.][^.][^.] does not exist -- skipping
considering log /var/log/mgetty.log.tty[^.][^.][^.][^.][^.][^.][^.][^.][^.]
  log /var/log/mgetty.log.tty[^.][^.][^.][^.][^.][^.][^.][^.][^.] does not exist -- skipping
considering log /var/log/mgetty.log.tty[^.][^.][^.][^.][^.][^.][^.][^.][^.][^.]
  log /var/log/mgetty.log.tty[^.][^.][^.][^.][^.][^.][^.][^.][^.][^.] does not exist -- skipping
considering log /var/log/mgetty.log.unknown
  log /var/log/mgetty.log.unknown does not exist -- skipping
considering log /var/log/mgetty.callback
  log /var/log/mgetty.callback does not exist -- skipping

rotating pattern: /var/log/ppp/connect-errors  after 1 days (5 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/ppp/connect-errors
  log /var/log/ppp/connect-errors does not exist -- skipping

rotating pattern: /var/account/pacct  after 1 days (31 rotations)
empty log files are not rotated, old logs are removed
considering log /var/account/pacct
  log does not need rotating

rotating pattern: /var/log/rpmpkgs  weekly (4 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/rpmpkgs
  log does not need rotating

rotating pattern: /var/log/messages /var/log/secure /var/log/maillog /var/log/spooler /var/log/boot.log /var/log/cron  weekly (4 rotations)
empty log files are rotated, old logs are removed
considering log /var/log/messages
  log does not need rotating
considering log /var/log/secure
  log does not need rotating
considering log /var/log/maillog
  log does not need rotating
considering log /var/log/spooler
  log does not need rotating
considering log /var/log/boot.log
  log does not need rotating
considering log /var/log/cron
  log does not need rotating
not running shared postrotate script, since no logs were rotated

rotating pattern: /var/log/up2date  weekly (4 rotations)
empty log files are rotated, old logs are removed
considering log /var/log/up2date
  log /var/log/up2date does not exist -- skipping

rotating pattern: /var/log/yum.log  30720 bytes (4 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/yum.log
  log does not need rotating

rotating pattern: /var/log/wtmp  monthly (1 rotations)
empty log files are rotated, old logs are removed
considering log /var/log/wtmp
  log does not need rotating

Also, depending upon the version of your OS, if /tmp is mounted noexec, that can also cause issues.

 

[4u123]

I'm getting errors like this...

rotating pattern: /var/log/exim_rejectlog weekly (4 rotations)
empty log files are rotated, old logs are removed
considering log /var/log/exim_rejectlog
log needs rotating
rotating log /var/log/exim_rejectlog, log->rotateCount is 4
renaming /var/log/exim_rejectlog.4.gz to /var/log/exim_rejectlog.5.gz (rotatecount 4, logstart 1, i 4),
renaming /var/log/exim_rejectlog.3.gz to /var/log/exim_rejectlog.4.gz (rotatecount 4, logstart 1, i 3),
renaming /var/log/exim_rejectlog.2.gz to /var/log/exim_rejectlog.3.gz (rotatecount 4, logstart 1, i 2),
renaming /var/log/exim_rejectlog.1.gz to /var/log/exim_rejectlog.2.gz (rotatecount 4, logstart 1, i 1),
renaming /var/log/exim_rejectlog.0.gz to /var/log/exim_rejectlog.1.gz (rotatecount 4, logstart 1, i 0),
renaming /var/log/exim_rejectlog to /var/log/exim_rejectlog.1
creating new log mode = 0640 uid = 47 gid = 12
running postrotate script
running script with arg /var/log/exim_rejectlog: "
/usr/bin/killall -HUP exim
"
error: unable to open /var/log/exim_rejectlog.1 for compression

In reality it doesnt seem to do any of the above. Its certainly not doing this

renaming /var/log/exim_rejectlog to /var/log/exim_rejectlog.1
creating new log mode = 0640 uid = 47 gid = 12

In /var/log I can see exim_rejectlog which is 167MB and exim_rejectlog.1.gz which is dated 27th Oct 2007. There are no other exim_rejectlog. files. Same goes for most of the other logs in there. Permissions are 640 and the ownership is mail mailnull.

I'm actually having this exact problem on 5 or 6 servers, all were built at around the same time.

 

[cPanelKenneth]

I'm getting errors like this...



In reality it doesnt seem to do any of the above. Its certainly not doing this



In /var/log I can see exim_rejectlog which is 167MB and exim_rejectlog.1.gz which is dated 27th Oct 2007. There are no other exim_rejectlog. files. Same goes for most of the other logs in there. Permissions are 640 and the ownership is mail mailnull.

I'm actually having this exact problem on 5 or 6 servers, all were built at around the same time.

Sorry, that's my fault. I told you to use the debugging (-d) flag, when I should have told you to use the verbose( -v) flag. Debugging mode makes no changes to the system. Verbose mode will perform the actual changes. So:

logrotate -v /etc/logrotate.conf

is what you acutally want. Sorry about that.

 

[4u123]

Ok that works fine - so its not a problem with the actual process - it must be a problem with the cron file.

Can you see anythign wrong with this...

#!/bin/sh

if [ ! -e "/logrotate_tmp" ]; then
	mkdir /logrotate_tmp
fi
export TMPDIR=/logrotate_tmp

/usr/sbin/logrotate /etc/logrotate.conf
EXITVALUE=$?
if [ $EXITVALUE != 0 ]; then
    /usr/bin/logger -t logrotate "ALERT exited abnormally with [$EXITVALUE]"
fi
exit 0

 

[4u123]

DOH - I'm so stupid!

I have a server setup script that, among other things, copies the cron file onto the server in place of the standard one. Theres a typo in the chmod line so its not setting the permisisons correctly. I went through all this without checking the permissions of the file - what a fool! I'm very sorry to have taken up your time Ken.

 

[cPanelKenneth]

DOH - I'm so stupid!

I have a server setup script that, among other things, copies the cron file onto the server in place of the standard one. Theres a typo in the chmod line so its not setting the permisisons correctly. I went through all this without checking the permissions of the file - what a fool! I'm very sorry to have taken up your time Ken.

No problem, everyone does things like that now and again. Might I suggest documenting your standard server setup and custom scripts? It can help when the mind is too focused on a problem to see the whole picture (let alone befuddled by too many tasks).