Hello and welcome to LQ. Please fill in your distro info in your profile.
Originally Posted by paul sanz
failed to rename /var/log/messages to /var/log/messages.1: Operation not permitted
I'm just gonna ask some questions...
When you use force, do you run that logrotate command as unprivileged user or as root?
Are the files in use by processes other than syslog ('fuser')?
Does the file have extended attributes set ('lsattr')?
Does the directory or file have wrong permissions ('stat' or 'ls -al')?
Is the partition mounted read-only ?
Does the fileystem has problems ('fsck -n')?
Has the file been logged to actually?
Any clues in other logs like syslog?
Running any LSM like SELinux, GRsecurity or other?