4u123

Well-Known Member
PartnerNOC
Jan 2, 2006
943
28
178
Hi,

I just noticed the logs on a couple of servers go back to november 2007. Can anyone suggest what might be the problem - I dont know anything about logrotate, is this a linux thing or a cpanel thing ? I've searched this forum but couldnt find an answer.
 

4u123

Well-Known Member
PartnerNOC
Jan 2, 2006
943
28
178
Thanks Kernow but I already use that.

The exim_mainlog file on one server goes back to the 21st Oct.

syslog appears to be running ok. Any other ideas ?
 

cPanelKenneth

cPanel Development
Staff member
Apr 7, 2006
4,607
79
458
cPanel Access Level
Root Administrator
logrotate is in OS thing. There should be logrotate entries in /etc/cron.daily Also check entries in /etc/logrotate.d

If you have /var/log/cron, you can also check that to determine why the files are not being rotated properly.
 

4u123

Well-Known Member
PartnerNOC
Jan 2, 2006
943
28
178
Thanks Ken,

I've checked /etc/cron.daily and /etc/logrotate.d both seem fine. I have compared the files on a server that isnt rotating to one that is working correctly - they are identical.

I've grep'd the cron log for "logrotate" but it came back with nothing - I searched for "error" - nothing and "cron.daily = just a load of Updated timestamp entries. What should I be looking for ?

Is there a way to run a log rotate from the command line so I can see what its doing ?
 

cPanelKenneth

cPanel Development
Staff member
Apr 7, 2006
4,607
79
458
cPanel Access Level
Root Administrator
You can execute logrotate manually. Use the -d flag to get feedback on what it is doing.

Code:
[email protected] [~]# logrotate -d /etc/logrotate.conf 
reading config file /etc/logrotate.conf
including /etc/logrotate.d
reading config file acpid
reading config info for /var/log/acpid 
reading config file cups
reading config info for /var/log/cups/*_log 
reading config file exim
reading config info for /var/log/exim_mainlog 
reading config info for /var/log/exim_paniclog 
reading config info for /var/log/exim_rejectlog 
reading config file mgetty
reading config info for /var/log/mgetty.log.tty[^.] /var/log/mgetty.log.tty[^.][^.] /var/log/mgetty.log.tty[^.][^.][^.] /var/log/mgetty.log.tty[^.][^.][^.][^.] /var/log/mgetty.log.tty[^.][^.][^.][^.][^.] /var/log/mgetty.log.tty[^.][^.][^.][^.][^.][^.] /var/log/mgetty.log.tty[^.][^.][^.][^.][^.][^.][^.] /var/log/mgetty.log.tty[^.][^.][^.][^.][^.][^.][^.][^.] /var/log/mgetty.log.tty[^.][^.][^.][^.][^.][^.][^.][^.][^.] /var/log/mgetty.log.tty[^.][^.][^.][^.][^.][^.][^.][^.][^.][^.] /var/log/mgetty.log.unknown /var/log/mgetty.callback 
reading config file mysql
reading config info for /var/lib/mysql/mysqld.log 
reading config file named
reading config info for /var/log/named.log 
reading config file ppp
reading config info for /var/log/ppp/connect-errors 
reading config file psacct
reading config info for /var/account/pacct 
reading config file rpm
reading config info for /var/log/rpmpkgs 
reading config file syslog
reading config info for /var/log/messages /var/log/secure /var/log/maillog /var/log/spooler /var/log/boot.log /var/log/cron 
reading config file up2date
reading config info for /var/log/up2date 
reading config file yum
reading config info for /var/log/yum.log 
reading config info for /var/log/wtmp 

Handling 15 logs

rotating pattern: /var/log/acpid  65536 bytes (4 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/acpid
  log does not need rotating

rotating pattern: /var/log/cups/*_log  weekly (4 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/cups/error_log
  log does not need rotating
not running shared postrotate script, since no logs were rotated

rotating pattern: /var/log/exim_mainlog  weekly (4 rotations)
empty log files are rotated, old logs are removed
considering log /var/log/exim_mainlog
  log does not need rotating

rotating pattern: /var/log/exim_paniclog  weekly (4 rotations)
empty log files are rotated, old logs are removed
considering log /var/log/exim_paniclog
  log does not need rotating

rotating pattern: /var/log/exim_rejectlog  weekly (4 rotations)
empty log files are rotated, old logs are removed
considering log /var/log/exim_rejectlog
  log does not need rotating

rotating pattern: /var/log/mgetty.log.tty[^.] /var/log/mgetty.log.tty[^.][^.] /var/log/mgetty.log.tty[^.][^.][^.] /var/log/mgetty.log.tty[^.][^.][^.][^.] /var/log/mgetty.log.tty[^.][^.][^.][^.][^.] /var/log/mgetty.log.tty[^.][^.][^.][^.][^.][^.] /var/log/mgetty.log.tty[^.][^.][^.][^.][^.][^.][^.] /var/log/mgetty.log.tty[^.][^.][^.][^.][^.][^.][^.][^.] /var/log/mgetty.log.tty[^.][^.][^.][^.][^.][^.][^.][^.][^.] /var/log/mgetty.log.tty[^.][^.][^.][^.][^.][^.][^.][^.][^.][^.] /var/log/mgetty.log.unknown /var/log/mgetty.callback  weekly (4 rotations)
empty log files are rotated, old logs are removed
considering log /var/log/mgetty.log.tty[^.]
  log /var/log/mgetty.log.tty[^.] does not exist -- skipping
considering log /var/log/mgetty.log.tty[^.][^.]
  log /var/log/mgetty.log.tty[^.][^.] does not exist -- skipping
considering log /var/log/mgetty.log.tty[^.][^.][^.]
  log /var/log/mgetty.log.tty[^.][^.][^.] does not exist -- skipping
considering log /var/log/mgetty.log.tty[^.][^.][^.][^.]
  log /var/log/mgetty.log.tty[^.][^.][^.][^.] does not exist -- skipping
considering log /var/log/mgetty.log.tty[^.][^.][^.][^.][^.]
  log /var/log/mgetty.log.tty[^.][^.][^.][^.][^.] does not exist -- skipping
considering log /var/log/mgetty.log.tty[^.][^.][^.][^.][^.][^.]
  log /var/log/mgetty.log.tty[^.][^.][^.][^.][^.][^.] does not exist -- skipping
considering log /var/log/mgetty.log.tty[^.][^.][^.][^.][^.][^.][^.]
  log /var/log/mgetty.log.tty[^.][^.][^.][^.][^.][^.][^.] does not exist -- skipping
considering log /var/log/mgetty.log.tty[^.][^.][^.][^.][^.][^.][^.][^.]
  log /var/log/mgetty.log.tty[^.][^.][^.][^.][^.][^.][^.][^.] does not exist -- skipping
considering log /var/log/mgetty.log.tty[^.][^.][^.][^.][^.][^.][^.][^.][^.]
  log /var/log/mgetty.log.tty[^.][^.][^.][^.][^.][^.][^.][^.][^.] does not exist -- skipping
considering log /var/log/mgetty.log.tty[^.][^.][^.][^.][^.][^.][^.][^.][^.][^.]
  log /var/log/mgetty.log.tty[^.][^.][^.][^.][^.][^.][^.][^.][^.][^.] does not exist -- skipping
considering log /var/log/mgetty.log.unknown
  log /var/log/mgetty.log.unknown does not exist -- skipping
considering log /var/log/mgetty.callback
  log /var/log/mgetty.callback does not exist -- skipping

rotating pattern: /var/log/ppp/connect-errors  after 1 days (5 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/ppp/connect-errors
  log /var/log/ppp/connect-errors does not exist -- skipping

rotating pattern: /var/account/pacct  after 1 days (31 rotations)
empty log files are not rotated, old logs are removed
considering log /var/account/pacct
  log does not need rotating

rotating pattern: /var/log/rpmpkgs  weekly (4 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/rpmpkgs
  log does not need rotating

rotating pattern: /var/log/messages /var/log/secure /var/log/maillog /var/log/spooler /var/log/boot.log /var/log/cron  weekly (4 rotations)
empty log files are rotated, old logs are removed
considering log /var/log/messages
  log does not need rotating
considering log /var/log/secure
  log does not need rotating
considering log /var/log/maillog
  log does not need rotating
considering log /var/log/spooler
  log does not need rotating
considering log /var/log/boot.log
  log does not need rotating
considering log /var/log/cron
  log does not need rotating
not running shared postrotate script, since no logs were rotated

rotating pattern: /var/log/up2date  weekly (4 rotations)
empty log files are rotated, old logs are removed
considering log /var/log/up2date
  log /var/log/up2date does not exist -- skipping

rotating pattern: /var/log/yum.log  30720 bytes (4 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/yum.log
  log does not need rotating

rotating pattern: /var/log/wtmp  monthly (1 rotations)
empty log files are rotated, old logs are removed
considering log /var/log/wtmp
  log does not need rotating
Also, depending upon the version of your OS, if /tmp is mounted noexec, that can also cause issues.
 
Last edited:

4u123

Well-Known Member
PartnerNOC
Jan 2, 2006
943
28
178
I'm getting errors like this...

rotating pattern: /var/log/exim_rejectlog weekly (4 rotations)
empty log files are rotated, old logs are removed
considering log /var/log/exim_rejectlog
log needs rotating
rotating log /var/log/exim_rejectlog, log->rotateCount is 4
renaming /var/log/exim_rejectlog.4.gz to /var/log/exim_rejectlog.5.gz (rotatecount 4, logstart 1, i 4),
renaming /var/log/exim_rejectlog.3.gz to /var/log/exim_rejectlog.4.gz (rotatecount 4, logstart 1, i 3),
renaming /var/log/exim_rejectlog.2.gz to /var/log/exim_rejectlog.3.gz (rotatecount 4, logstart 1, i 2),
renaming /var/log/exim_rejectlog.1.gz to /var/log/exim_rejectlog.2.gz (rotatecount 4, logstart 1, i 1),
renaming /var/log/exim_rejectlog.0.gz to /var/log/exim_rejectlog.1.gz (rotatecount 4, logstart 1, i 0),
renaming /var/log/exim_rejectlog to /var/log/exim_rejectlog.1
creating new log mode = 0640 uid = 47 gid = 12
running postrotate script
running script with arg /var/log/exim_rejectlog: "
/usr/bin/killall -HUP exim
"
error: unable to open /var/log/exim_rejectlog.1 for compression
In reality it doesnt seem to do any of the above. Its certainly not doing this

renaming /var/log/exim_rejectlog to /var/log/exim_rejectlog.1
creating new log mode = 0640 uid = 47 gid = 12
In /var/log I can see exim_rejectlog which is 167MB and exim_rejectlog.1.gz which is dated 27th Oct 2007. There are no other exim_rejectlog. files. Same goes for most of the other logs in there. Permissions are 640 and the ownership is mail mailnull.

I'm actually having this exact problem on 5 or 6 servers, all were built at around the same time.
 

cPanelKenneth

cPanel Development
Staff member
Apr 7, 2006
4,607
79
458
cPanel Access Level
Root Administrator
I'm getting errors like this...



In reality it doesnt seem to do any of the above. Its certainly not doing this



In /var/log I can see exim_rejectlog which is 167MB and exim_rejectlog.1.gz which is dated 27th Oct 2007. There are no other exim_rejectlog. files. Same goes for most of the other logs in there. Permissions are 640 and the ownership is mail mailnull.

I'm actually having this exact problem on 5 or 6 servers, all were built at around the same time.
Sorry, that's my fault. I told you to use the debugging (-d) flag, when I should have told you to use the verbose( -v) flag. Debugging mode makes no changes to the system. Verbose mode will perform the actual changes. So:

logrotate -v /etc/logrotate.conf

is what you acutally want. Sorry about that.
 

4u123

Well-Known Member
PartnerNOC
Jan 2, 2006
943
28
178
Ok that works fine - so its not a problem with the actual process - it must be a problem with the cron file.

Can you see anythign wrong with this...

Code:
#!/bin/sh

if [ ! -e "/logrotate_tmp" ]; then
	mkdir /logrotate_tmp
fi
export TMPDIR=/logrotate_tmp

/usr/sbin/logrotate /etc/logrotate.conf
EXITVALUE=$?
if [ $EXITVALUE != 0 ]; then
    /usr/bin/logger -t logrotate "ALERT exited abnormally with [$EXITVALUE]"
fi
exit 0
 

4u123

Well-Known Member
PartnerNOC
Jan 2, 2006
943
28
178
DOH - I'm so stupid!

I have a server setup script that, among other things, copies the cron file onto the server in place of the standard one. Theres a typo in the chmod line so its not setting the permisisons correctly. I went through all this without checking the permissions of the file - what a fool! I'm very sorry to have taken up your time Ken.
 

cPanelKenneth

cPanel Development
Staff member
Apr 7, 2006
4,607
79
458
cPanel Access Level
Root Administrator
DOH - I'm so stupid!

I have a server setup script that, among other things, copies the cron file onto the server in place of the standard one. Theres a typo in the chmod line so its not setting the permisisons correctly. I went through all this without checking the permissions of the file - what a fool! I'm very sorry to have taken up your time Ken.
No problem, everyone does things like that now and again. Might I suggest documenting your standard server setup and custom scripts? It can help when the mind is too focused on a problem to see the whole picture (let alone befuddled by too many tasks).