[SOLVED] - logrotate not keeping allocated files

General support questions
Post Reply
User avatar
warron.french
Posts: 616
Joined: 2014/03/27 20:21:58

[SOLVED] - logrotate not keeping allocated files

Post by warron.french » 2021/07/09 18:03:55

We are having problems with the logrotate suite not rolling (and more importantly keeping) log files, on a Red Hat 7.9 server. Just one.
The logfiles in question are the ones listed within the /etc/logrotate.d/syslog file.
The /etc/logrotate.d/syslog was altered by someone where the /var/log/cron entry was changed to /var/log/cron.log; which is being generated by the /etc/rsyslog.conf file (another deviation from standards, I know).

All of the targets listed in /etc/logrotate.d/syslog:
  • /var/log/cron.log
  • /var/log/message
  • /var/log/maillog
  • /var/log/spooler
  • /var/log/secure

do exist, but when logrotate takes action, the files are merely deleted and a new one generated with the standard (cron.log is the exceptional) name.

There is no size directive in either the /etc/logrotate.d/syslog or the /etc/logrotate.conf files.
There is a rotate 8, meaning keep 8 backup/old files, listed in /etc/logrotate.conf.

The machine in question is in an AWS environment.

When I execute logrotate -d, to check debugging output I do not really see any issues, except that it won't rotate the logfiles spooler and maillog, because they are of zero length; no really a concern.

Any other suggestions of what I could try to change to look for a change in behavior, or where else to look for useful logging?
Last edited by warron.french on 2021/08/06 19:16:45, edited 1 time in total.
Thanks,
War

Whoever
Posts: 1357
Joined: 2013/09/06 03:12:10

Re: logrotate not keeping allocated files

Post by Whoever » 2021/07/10 00:54:41

How about posting the contents of /etc/logrotate.d/syslog and /etc/logrotate.conf?

Also check that none of the files are listed in other files in /etc/logrotate.d/

User avatar
warron.french
Posts: 616
Joined: 2014/03/27 20:21:58

Re: logrotate not keeping allocated files

Post by warron.french » 2021/07/12 12:25:34

Here are the snippets about the files:
===/etc/logrotate.conf===

Code: Select all

weekly
rotate  8
create 
compress
dateext
include  /etc/logrotate.d
===/etc/logrotate.d/syslog===

Code: Select all

/var/log/cron.log
/var/log/maillog
/var/log/messages
/var/log/secure
/var/log/spooler
{
   missingok
   sharedscripts
   postrotate
      /bin/kill -HUP `cat /var/run/syslogd.pid`  2>  /dev/null  || true
   endscript
}
I used the following to determine if the log files were being logrotated anywhere else:

Code: Select all

egrep '(cron.log|maillog|messages|secure|spooler)' /etc/logrotate.d/*
I found nothing other than /etc/logrotate.d/syslog.
Thanks,
War

Whoever
Posts: 1357
Joined: 2013/09/06 03:12:10

Re: logrotate not keeping allocated files

Post by Whoever » 2021/07/13 06:00:55

Have you searched all the possible cron directories for something else that is doing log rotation?

User avatar
warron.french
Posts: 616
Joined: 2014/03/27 20:21:58

Re: logrotate not keeping allocated files

Post by warron.french » 2021/07/13 14:31:47

Oh crap! Are you referring to
  • /etc/cron.d
  • /etc/cron.daily
  • /etc/cron.hourly
?

I did not think of checking them, no.
Thanks,
War

User avatar
TrevorH
Site Admin
Posts: 33191
Joined: 2009/09/24 10:40:56
Location: Brighton, UK

Re: logrotate not keeping allocated files

Post by TrevorH » 2021/07/13 16:22:01

Also please note that logrotate is extremely susceptible to config errors since any parameters given that are not inside a log section are treated as global overrides and apply to all log files that do not explicitly set that same parameter. For example, to use a supplied file like

Code: Select all

# no packages own wtmp -- we'll rotate it here
/var/log/wtmp {
    missingok
    monthly
    create 0664 root utmp
    minsize 1M
    rotate 1
}
If you edited that and added "compress" to that file and put the parameter anywhere in that file outside the {} then it immediately becomes a global option and applies to all other files that are also included.
The future appears to be RHEL or Debian. I think I'm going Debian.
Info for USB installs on http://wiki.centos.org/HowTos/InstallFromUSBkey
CentOS 5 and 6 are deadest, do not use them.
Use the FAQ Luke

User avatar
warron.french
Posts: 616
Joined: 2014/03/27 20:21:58

Re: logrotate not keeping allocated files

Post by warron.french » 2021/07/13 17:52:46

Thanks TrevorH,

I don't believe the snippets I provided are showing that. I will review all other logfiles and confirm that there are not any misplaced directives like you are talking about. THIS is good information to remember, as I was never aware of that myself.

Thanks guys. I will keep working on this.
Thanks,
War

Whoever
Posts: 1357
Joined: 2013/09/06 03:12:10

Re: logrotate not keeping allocated files

Post by Whoever » 2021/07/14 02:59:47

warron.french wrote:
2021/07/13 14:31:47
Oh crap! Are you referring to
  • /etc/cron.d
  • /etc/cron.daily
  • /etc/cron.hourly
?

I did not think of checking them, no.
/etc/cron.weekly
/etc/cron.monthly

Also root's crontab ("crontab -e").

User avatar
warron.french
Posts: 616
Joined: 2014/03/27 20:21:58

Re: logrotate not keeping allocated files

Post by warron.french » 2021/07/15 18:25:29

Now that I think about it, I was trying to execute

Code: Select all

logrotate -f /etc/logrotate.d/syslog
from root's crontab at midnight specifically on Sundays.

That must have been the problem.
Thanks,
War

Post Reply