logrotate cannot rotate some log files

André Nunes Batista

unread,

Jun 14, 2014, 9:00:02 PM6/14/14

to

Hello debianers!

I recently noticed that some log files on a wheezy box are not being
rotated anymore and are getting rather large. I went through
logrotate.conf and logrotate.d and did not spot anything wrong. When I
run logrotate -f -v /etc/logrotate.conf, some error messages are shown,
but they are not quite helpful in solving the issue.

For example, /var/log/syslog:

#ls -lsh /var/log/syslog
1.2G -rw-r----- 1 root adm 1.2G Jun 14 21:33 /var/log/syslog

# cat /etc/logrotate.d/rsyslog
/var/log/syslog
{
rotate 7
daily
missingok
notifempty
delaycompress
compress
postrotate
invoke-rc.d rsyslog rotate > /dev/null
endscript
}

# logrotate -f -v /etc/logrotate.d/ 2> logrotate.txt

# cat logrotate.txt | grep syslog
reading config file rsyslog
rotating pattern: /var/log/syslog
considering log /var/log/syslog
rotating log /var/log/syslog, log->rotateCount is 7
error: error creating output file /var/log/syslog.1.gz: File exists
log /var/log/syslog.8.gz doesn't exist -- won't try to dispose of it

# ls -lsh /var/log/syslog.1.gz
0 -rw-r----- 1 root adm 0 Feb 9 07:35 /var/log/syslog.1.gz

# ls -lsh /var/log/syslog.1
3.8M -rw-r----- 1 root adm 3.8M Feb 8 07:35 /var/log/syslog.1

So this issue appears to go back some months already, but I have no clue
why it started. Also, it does no happen to every log file on /var/log,
just some, eg., messages, debug, kern.log, auth.log.

Could someone please give a hint on how might I solve this issue?

Thanks!

--
André N. Batista
GNUPG/PGP KEY: 6722CF80

signature.asc

Bzzzz

unread,

Jun 14, 2014, 9:20:01 PM6/14/14

to

On Sat, 14 Jun 2014 21:49:35 -0300
André Nunes Batista <andren...@gmail.com> wrote:

> 0 -rw-r----- 1 root adm 0 Feb 9 07:35 /var/log/syslog.1.gz

Move out syslog* to another place and restart syslog
(looks like you have a hole in file numbering).

If that doesn't work, try to reinstall logrotate and
rsyslog (or switch to syslog-ng).

--
<thithi> And you, who knows you best?
<fred> my mother
<bgdu60> my girlfriend :)
<isis> uuh... my sister I guess
<tercalen> google...

signature.asc

Andrew McGlashan

unread,

Jun 15, 2014, 1:00:01 AM6/15/14

to

On 15/06/2014 10:49 AM, André Nunes Batista wrote:
> # logrotate -f -v /etc/logrotate.d/ 2> logrotate.txt
>
> # cat logrotate.txt | grep syslog
> reading config file rsyslog
> rotating pattern: /var/log/syslog
> considering log /var/log/syslog
> rotating log /var/log/syslog, log->rotateCount is 7
> error: error creating output file /var/log/syslog.1.gz: File exists
> log /var/log/syslog.8.gz doesn't exist -- won't try to dispose of it
>
> # ls -lsh /var/log/syslog.1.gz
> 0 -rw-r----- 1 root adm 0 Feb 9 07:35 /var/log/syslog.1.gz
>
> # ls -lsh /var/log/syslog.1
> 3.8M -rw-r----- 1 root adm 3.8M Feb 8 07:35 /var/log/syslog.1
>
> So this issue appears to go back some months already, but I have no clue
> why it started. Also, it does no happen to every log file on /var/log,
> just some, eg., messages, debug, kern.log, auth.log.

It may have happened when logrotate tried to run twice on the same day.

The easiest thing to do is to rename the /old/ problem files (or move
them) and then try again to do a logrotate.

Cheers
A.

signature.asc