Bug 452954 – app-admin/logrotate-3.8.[0-3]: logfiles are not rotated

• Status: RESOLVED WORKSFORME
• Product: Gentoo Linux

[Description Juergen Rose 2013-01-19 12:19:57 UTC]

/var/log/messages was not rotated for more than a year:
root@condor:/root(22)# ll /var/log/messages*
-rw------- 1 root root 642903671 Jan 19 12:50 /var/log/messages
-rw------- 1 root root     66409 Jun 19  2011 /var/log/messages-20110619.gz
-rw------- 1 root root     28514 Jun 26  2011 /var/log/messages-20110626.gz
-rw------- 1 root root     46842 Jul  3  2011 /var/log/messages-20110703.gz
-rw------- 1 root root     26285 Jul 10  2011 /var/log/messages-20110710.gz
root@condor:/root(23)# genlop -t logrotate | tail -n 15
     Mon Apr 18 06:43:40 2011 >>> app-admin/logrotate-3.7.9-r2
       merge time: 9 seconds.

     Sun Jul 10 07:17:11 2011 >>> app-admin/logrotate-3.8.0
       merge time: 11 seconds.

     Sat Oct 15 09:10:24 2011 >>> app-admin/logrotate-3.8.1
       merge time: 8 seconds.

     Fri Aug  3 06:26:54 2012 >>> app-admin/logrotate-3.8.2
       merge time: 8 seconds.

     Mon Nov 12 06:52:32 2012 >>> app-admin/logrotate-3.8.3
       merge time: 13 seconds.


'logrotate' should be activated by crond, crond is runnning:

root@condor:/root(24)# /etc/init.d/vixie-cron status
 * status: started


'vixie-cron' should start logrotate via /etc/cron.daily/logrotate.cron

root@condor:/root(39)# ll /etc/cron.daily/logrotate.cron
-rwxr-xr-x 1 root root 52 Nov 12 06:52 /etc/cron.daily/logrotate.cron*
root@condor:/root(40)# cat /etc/cron.daily/logrotate.cron
#! /bin/sh

/usr/sbin/logrotate /etc/logrotate.conf


"/etc/logrotate.conf" has the following properties:

root@condor:/root(27)# ll /etc/logrotate.conf
-rw-r--r-- 1 rose root 1679 Sep 14  2009 /etc/logrotate.conf
root@condor:/root(28)# grep "^[^#]" /etc/logrotate.conf
weekly
rotate 4
create
dateext
compress
include /etc/logrotate.d
notifempty
nomail
noolddir
/var/log/wtmp {
    monthly
    create 0664 root utmp
    rotate 3
}
/var/log/btmp {
    missingok
    monthly
    create 0600 root utmp
    rotate 1
}
/var/log/net-snmpd.log {
    monthly
    create 0600 root root
    rotate 4
}
/var/log/esync.log {
        monthly 
        rotate 3
                create
                compress
}


and by the files in /etc/logrotate.d:
root@condor:/root(29)# ll /etc/logrotate.d
total 72
-rw-r--r-- 1 root root  209 Oct 21  2011 acct
-rw-r--r-- 1 root root  221 Dec 31 17:19 apache2
-rw-r--r-- 1 root root  377 Nov  2 09:25 cherokee
-rw-r--r-- 1 root root  355 Dec 12 06:31 clamav
-rw-r--r-- 1 root root  150 Jan 13 06:40 couchdb
-rw-r--r-- 1 root root   92 Jan  9 12:23 dracut
-rw-r--r-- 1 root root  272 Jan 19 11:15 elog-save-summary
-rw-r--r-- 1 root root   79 Jan 13 06:30 hibernate-script
-rw-r--r-- 1 root root  111 Jan  6 11:24 kdm
-rw-r--r-- 1 root root  165 Jan  9 12:27 libvirtd
-rw-r--r-- 1 root root  162 Jan  9 12:27 libvirtd.lxc
-rw-r--r-- 1 root root  163 Jan  9 12:27 libvirtd.qemu
-rw-r--r-- 1 root root  162 Jan  9 12:27 libvirtd.uml
-rw-r--r-- 1 root root  267 Oct 25 06:21 mcelog
-rw-r--r-- 1 root root  491 Jan 19 03:21 mysql
-rw-r--r-- 1 root root   71 Dec 27 17:31 openrc
-rw-r--r-- 1 root root  105 Dec 27 10:59 rsyncd
-rw-r--r-- 1 root root 1685 Dec 23  2009 syslog-ng


/var/log/messages should be rotated by /etc/logrotate.d/syslog-ng:

root@condor:/root(31)# grep "^[^#]" /etc/logrotate.d/syslog-ng 
/var/log/messages {
    missingok
    sharedscripts
    postrotate
        /etc/init.d/syslog-ng reload > /dev/null 2>&1 || true
    endscript
}
/var/log/debug /var/log/syslog /var/log/kern.log {
    sharedscripts
    postrotate
        /etc/init.d/syslog-ng reload > /dev/null 2>&1 || true
    endscript
}
/var/log/cron.log /var/log/daemon.log /var/log/lpr.log /var/log/uucp.log {
    sharedscripts
    missingok
    postrotate
        /etc/init.d/syslog-ng reload > /dev/null 2>&1 || true
    endscript
}
/var/log/user.log {
    sharedscripts
    postrotate
        /etc/init.d/syslog-ng reload > /dev/null 2>&1 || true
    endscript
}
/var/log/news/news.crit /var/log/news/news.err /var/log/news/news.notice {
    sharedscripts
    missingok
    postrotate
        /etc/init.d/syslog-ng reload > /dev/null 2>&1 || true
    endscript
}
/var/log/mail.log /var/log/mail.info /var/log/mail.err /var/log/mail.warn {
    sharedscripts
    missingok
    postrotate
        /etc/init.d/syslog-ng reload > /dev/null 2>&1 || true
    endscript
}
/var/log/avc.log /var/log/audit.log /var/log/pax.log /var/log/grsec.log {
    sharedscripts
    missingok
    postrotate
        /etc/init.d/syslog-ng reload > /dev/null 2>&1 || true
    endscript
}
/var/log/auth.log {
    sharedscripts
    postrotate
        /etc/init.d/syslog-ng reload > /dev/null 2>&1 || true
    endscript
}


cron daemon is running as root:

root@condor:/root(42)# ps -ef | grep cron
root      7198     1  0  2012 ?        00:00:01 /usr/sbin/cron
root     11562 24469  0 13:10 pts/4    00:00:00 grep --colour=auto cron

It is shown that lograte was executed daily:
root@condor:/root(48)# grep logrot /var/log/messages | tail
Jan 10 03:10:13 condor run-crons[25422]: (root) CMD (/etc/cron.daily/logrotate.cron)
Jan 11 03:10:09 condor run-crons[10261]: (root) CMD (/etc/cron.daily/logrotate.cron)
Jan 12 03:10:10 condor run-crons[30944]: (root) CMD (/etc/cron.daily/logrotate.cron)
Jan 13 03:10:11 condor run-crons[10181]: (root) CMD (/etc/cron.daily/logrotate.cron)
Jan 14 03:10:11 condor run-crons[12115]: (root) CMD (/etc/cron.daily/logrotate.cron)
Jan 15 03:10:10 condor run-crons[19465]: (root) CMD (/etc/cron.daily/logrotate.cron)
Jan 16 03:10:13 condor run-crons[11833]: (root) CMD (/etc/cron.daily/logrotate.cron)
Jan 17 03:10:10 condor run-crons[3018]: (root) CMD (/etc/cron.daily/logrotate.cron)
Jan 18 03:10:12 condor run-crons[11162]: (root) CMD (/etc/cron.daily/logrotate.cron)
Jan 19 03:10:08 condor run-crons[27654]: (root) CMD (/etc/cron.daily/logrotate.cron)


Maybe there is now not enough free place in the /var partition to rotate /var/log/messages:

root@condor:/root(49)# du -s /var/log/messages
628460  /var/log/messages
root@condor:/root(50)# df /var
Filesystem          1K-blocks    Used Available Use% Mounted on
/dev/mapper/vg1-var   4128448 3452052    466684  89% /var

but this should not the case some month ago and at least I can still manually compress /var/log/messages:

root@condor:/var/log(53)# du -s /var/log/messages*
72      /var/log/messages-20110619.gz
28      /var/log/messages-20110626.gz
48      /var/log/messages-20110703.gz
28      /var/log/messages-20110710.gz
40684   /var/log/messages.gz
root@condor:/var/log(54)# df /var
Filesystem          1K-blocks    Used Available Use% Mounted on
/dev/mapper/vg1-var   4128448 2865140   1053596  74% /var



Any hint is appreciated.

[Comment 1 Juergen Rose 2013-01-20 14:20:00 UTC]

I think, I found the reason. I tried to run logrotate manually and detected, that the owner of  /etc/logrotate.conf was not correct:

root@condor:/usr/src/linux(53)# logrotate -v /etc/logrotate.conf
Ignoring /etc/logrotate.conf because the file owner is wrong (should be root).

Handling 0 logs
root@condor:/usr/src/linux(54)# ll /etc/logrotate.conf
-rw-r--r-- 1 rose root 1679 Sep 14  2009 /etc/logrotate.conf
root@condor:/usr/src/linux(55)# chown root /etc/logrotate.conf
root@condor:/usr/src/linux(56)# logrotate -v /etc/logrotate.conf
reading config file /etc/logrotate.conf
including /etc/logrotate.d
reading config file acct
...

[Comment 2 Chema Alonso Josa (RETIRED) 2013-01-20 22:14:30 UTC]

(In reply to comment #1)
> I think, I found the reason. I tried to run logrotate manually and detected,
> that the owner of  /etc/logrotate.conf was not correct:
> 

Did it work?

Can we close this bug?

[Comment 3 Juergen Rose 2013-01-21 10:13:45 UTC]

I think it works and bug can be closed.

[Comment 4 Chema Alonso Josa (RETIRED) 2013-01-21 12:21:10 UTC]

Ok, closing... reopen if necessary

Thanks.