/var/log/messages was not rotated for more than a year: root@condor:/root(22)# ll /var/log/messages* -rw------- 1 root root 642903671 Jan 19 12:50 /var/log/messages -rw------- 1 root root 66409 Jun 19 2011 /var/log/messages-20110619.gz -rw------- 1 root root 28514 Jun 26 2011 /var/log/messages-20110626.gz -rw------- 1 root root 46842 Jul 3 2011 /var/log/messages-20110703.gz -rw------- 1 root root 26285 Jul 10 2011 /var/log/messages-20110710.gz root@condor:/root(23)# genlop -t logrotate | tail -n 15 Mon Apr 18 06:43:40 2011 >>> app-admin/logrotate-3.7.9-r2 merge time: 9 seconds. Sun Jul 10 07:17:11 2011 >>> app-admin/logrotate-3.8.0 merge time: 11 seconds. Sat Oct 15 09:10:24 2011 >>> app-admin/logrotate-3.8.1 merge time: 8 seconds. Fri Aug 3 06:26:54 2012 >>> app-admin/logrotate-3.8.2 merge time: 8 seconds. Mon Nov 12 06:52:32 2012 >>> app-admin/logrotate-3.8.3 merge time: 13 seconds. 'logrotate' should be activated by crond, crond is runnning: root@condor:/root(24)# /etc/init.d/vixie-cron status * status: started 'vixie-cron' should start logrotate via /etc/cron.daily/logrotate.cron root@condor:/root(39)# ll /etc/cron.daily/logrotate.cron -rwxr-xr-x 1 root root 52 Nov 12 06:52 /etc/cron.daily/logrotate.cron* root@condor:/root(40)# cat /etc/cron.daily/logrotate.cron #! /bin/sh /usr/sbin/logrotate /etc/logrotate.conf "/etc/logrotate.conf" has the following properties: root@condor:/root(27)# ll /etc/logrotate.conf -rw-r--r-- 1 rose root 1679 Sep 14 2009 /etc/logrotate.conf root@condor:/root(28)# grep "^[^#]" /etc/logrotate.conf weekly rotate 4 create dateext compress include /etc/logrotate.d notifempty nomail noolddir /var/log/wtmp { monthly create 0664 root utmp rotate 3 } /var/log/btmp { missingok monthly create 0600 root utmp rotate 1 } /var/log/net-snmpd.log { monthly create 0600 root root rotate 4 } /var/log/esync.log { monthly rotate 3 create compress } and by the files in /etc/logrotate.d: root@condor:/root(29)# ll /etc/logrotate.d total 72 -rw-r--r-- 1 root root 209 Oct 21 2011 acct -rw-r--r-- 1 root root 221 Dec 31 17:19 apache2 -rw-r--r-- 1 root root 377 Nov 2 09:25 cherokee -rw-r--r-- 1 root root 355 Dec 12 06:31 clamav -rw-r--r-- 1 root root 150 Jan 13 06:40 couchdb -rw-r--r-- 1 root root 92 Jan 9 12:23 dracut -rw-r--r-- 1 root root 272 Jan 19 11:15 elog-save-summary -rw-r--r-- 1 root root 79 Jan 13 06:30 hibernate-script -rw-r--r-- 1 root root 111 Jan 6 11:24 kdm -rw-r--r-- 1 root root 165 Jan 9 12:27 libvirtd -rw-r--r-- 1 root root 162 Jan 9 12:27 libvirtd.lxc -rw-r--r-- 1 root root 163 Jan 9 12:27 libvirtd.qemu -rw-r--r-- 1 root root 162 Jan 9 12:27 libvirtd.uml -rw-r--r-- 1 root root 267 Oct 25 06:21 mcelog -rw-r--r-- 1 root root 491 Jan 19 03:21 mysql -rw-r--r-- 1 root root 71 Dec 27 17:31 openrc -rw-r--r-- 1 root root 105 Dec 27 10:59 rsyncd -rw-r--r-- 1 root root 1685 Dec 23 2009 syslog-ng /var/log/messages should be rotated by /etc/logrotate.d/syslog-ng: root@condor:/root(31)# grep "^[^#]" /etc/logrotate.d/syslog-ng /var/log/messages { missingok sharedscripts postrotate /etc/init.d/syslog-ng reload > /dev/null 2>&1 || true endscript } /var/log/debug /var/log/syslog /var/log/kern.log { sharedscripts postrotate /etc/init.d/syslog-ng reload > /dev/null 2>&1 || true endscript } /var/log/cron.log /var/log/daemon.log /var/log/lpr.log /var/log/uucp.log { sharedscripts missingok postrotate /etc/init.d/syslog-ng reload > /dev/null 2>&1 || true endscript } /var/log/user.log { sharedscripts postrotate /etc/init.d/syslog-ng reload > /dev/null 2>&1 || true endscript } /var/log/news/news.crit /var/log/news/news.err /var/log/news/news.notice { sharedscripts missingok postrotate /etc/init.d/syslog-ng reload > /dev/null 2>&1 || true endscript } /var/log/mail.log /var/log/mail.info /var/log/mail.err /var/log/mail.warn { sharedscripts missingok postrotate /etc/init.d/syslog-ng reload > /dev/null 2>&1 || true endscript } /var/log/avc.log /var/log/audit.log /var/log/pax.log /var/log/grsec.log { sharedscripts missingok postrotate /etc/init.d/syslog-ng reload > /dev/null 2>&1 || true endscript } /var/log/auth.log { sharedscripts postrotate /etc/init.d/syslog-ng reload > /dev/null 2>&1 || true endscript } cron daemon is running as root: root@condor:/root(42)# ps -ef | grep cron root 7198 1 0 2012 ? 00:00:01 /usr/sbin/cron root 11562 24469 0 13:10 pts/4 00:00:00 grep --colour=auto cron It is shown that lograte was executed daily: root@condor:/root(48)# grep logrot /var/log/messages | tail Jan 10 03:10:13 condor run-crons[25422]: (root) CMD (/etc/cron.daily/logrotate.cron) Jan 11 03:10:09 condor run-crons[10261]: (root) CMD (/etc/cron.daily/logrotate.cron) Jan 12 03:10:10 condor run-crons[30944]: (root) CMD (/etc/cron.daily/logrotate.cron) Jan 13 03:10:11 condor run-crons[10181]: (root) CMD (/etc/cron.daily/logrotate.cron) Jan 14 03:10:11 condor run-crons[12115]: (root) CMD (/etc/cron.daily/logrotate.cron) Jan 15 03:10:10 condor run-crons[19465]: (root) CMD (/etc/cron.daily/logrotate.cron) Jan 16 03:10:13 condor run-crons[11833]: (root) CMD (/etc/cron.daily/logrotate.cron) Jan 17 03:10:10 condor run-crons[3018]: (root) CMD (/etc/cron.daily/logrotate.cron) Jan 18 03:10:12 condor run-crons[11162]: (root) CMD (/etc/cron.daily/logrotate.cron) Jan 19 03:10:08 condor run-crons[27654]: (root) CMD (/etc/cron.daily/logrotate.cron) Maybe there is now not enough free place in the /var partition to rotate /var/log/messages: root@condor:/root(49)# du -s /var/log/messages 628460 /var/log/messages root@condor:/root(50)# df /var Filesystem 1K-blocks Used Available Use% Mounted on /dev/mapper/vg1-var 4128448 3452052 466684 89% /var but this should not the case some month ago and at least I can still manually compress /var/log/messages: root@condor:/var/log(53)# du -s /var/log/messages* 72 /var/log/messages-20110619.gz 28 /var/log/messages-20110626.gz 48 /var/log/messages-20110703.gz 28 /var/log/messages-20110710.gz 40684 /var/log/messages.gz root@condor:/var/log(54)# df /var Filesystem 1K-blocks Used Available Use% Mounted on /dev/mapper/vg1-var 4128448 2865140 1053596 74% /var Any hint is appreciated.
I think, I found the reason. I tried to run logrotate manually and detected, that the owner of /etc/logrotate.conf was not correct: root@condor:/usr/src/linux(53)# logrotate -v /etc/logrotate.conf Ignoring /etc/logrotate.conf because the file owner is wrong (should be root). Handling 0 logs root@condor:/usr/src/linux(54)# ll /etc/logrotate.conf -rw-r--r-- 1 rose root 1679 Sep 14 2009 /etc/logrotate.conf root@condor:/usr/src/linux(55)# chown root /etc/logrotate.conf root@condor:/usr/src/linux(56)# logrotate -v /etc/logrotate.conf reading config file /etc/logrotate.conf including /etc/logrotate.d reading config file acct ...
(In reply to comment #1) > I think, I found the reason. I tried to run logrotate manually and detected, > that the owner of /etc/logrotate.conf was not correct: > Did it work? Can we close this bug?
I think it works and bug can be closed.
Ok, closing... reopen if necessary Thanks.