Log rotate not rotate

newFreeBSD · 09-04-2013, 01:31 AM

Hi,

I'm using SLES 11 SP1. I have set to rotate file firewall in /var/log. But seems it's not rotate. It be bigger than 1GB. This is config:

Code:

#
# Please note, that changing of log file permissions in this
# file is not sufficient if syslog-ng is used as log daemon.
#
# It is required to specify the permissions in the syslog-ng
# configuration file /etc/syslog-ng/syslog-ng.conf as well.
#

# the firewall,acpid,NetworkManager log files
# are used by syslog-ng and rsyslog only, the
# other by all syslog daemons.
/var/log/warn /var/log/messages /var/log/allmessages /var/log/localmessages /var/log/acpid /var/log/NetworkManager {
    compress
    dateext
    rotate 20
    missingok
    notifempty
    size 5M
    create 640 root root
    sharedscripts
    postrotate
        /etc/init.d/syslog reload
    endscript
}

# used by all syslog daemons
/var/log/mail /var/log/mail.info /var/log/mail.warn /var/log/mail.err {
    compress
    dateext
    maxage 365
    rotate 99
    missingok
    notifempty
    size +4096k
    create 640 root root
    sharedscripts
    postrotate
        /etc/init.d/syslog reload
    endscript
}

# used by all syslog daemons
/var/log/news/news.crit /var/log/news/news.err /var/log/news/news.notice {
    compress
    dateext
    maxage 365
    rotate 99
    missingok
    notifempty
    size +4096k
    create 640 news news
    sharedscripts
    postrotate
        /etc/init.d/syslog reload
    endscript
}
/var/log/firewall {
    compress
    rotate 10
    size 5120k
    sharedscripts
    postrotate
        /etc/init.d/syslog reload
    endscript
}

Please assist me if logrotate not correct.

Thanks.

zhjim · 09-04-2013, 02:54 AM

You can debug logrotate with the -d option. See what gives

Code:

logrotate -d /etc/logrotate.conf

newFreeBSD · 09-04-2013, 03:15 AM

Here i got:

Code:

rotating pattern: /var/log/firewall  5242880 bytes (5 rotations)
empty log files are rotated, old logs are removed
considering log /var/log/firewall
  log needs rotating
rotating log /var/log/firewall, log->rotateCount is 5
dateext suffix '-20130904'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
removing /var/log/firewall-20130818.bz2
removing old log /var/log/firewall-20130818.bz2
removing /var/log/firewall-20130819.bz2
removing old log /var/log/firewall-20130819.bz2
removing /var/log/firewall-20130820.bz2
removing old log /var/log/firewall-20130820.bz2
removing /var/log/firewall-20130821.bz2
removing old log /var/log/firewall-20130821.bz2
removing /var/log/firewall-20130822.bz2
removing old log /var/log/firewall-20130822.bz2
renaming /var/log/firewall to /var/log/firewall-20130904
creating new /var/log/firewall mode = 0664 uid = 0 gid = 0
running postrotate script
running script with arg /var/log/firewall : "
        /etc/init.d/syslog reload
"
compressing log with: /usr/bin/bzip2
removing old log /var/log/firewall-20130823.bz2

druuna · 09-04-2013, 03:54 AM

@newFreeBSD: What is the actual problem?

Looking at post #3 I see that old compressed files are removed, current firewal log is moved to firewal-<datestamp> and a new firewal log is created.

Quote:

It be bigger than 1GB.

You mention a wanted rotate size of 1Gb, but the rotate size given in logrotate is 5120k:

Code:

/var/log/firewall {
    compress
    rotate 10
    size 5120k
    sharedscripts
    postrotate
        /etc/init.d/syslog reload
    endscript
}

Could that be the problem?

newFreeBSD · 09-04-2013, 10:07 PM

How to set each file rotate not bigger than 1GB? Here is result today:

Code:

3.4G    firewall
32M     firewall-09032013.tar.gz
35M     firewall-20130824.bz2
0       firewall-20130825.bz2
14M     firewall-20130902.bz2
27M     firewall-20130903.bz2
9.4M    firewall-20130904.bz2

As you can see, it's not rotate the log. Any idea why? How to make it rotate?

Thanks.

druuna · 09-05-2013, 01:39 AM

This should work:

Code:

/var/log/firewall {
    rotate 10
    size 1024M
    compress
    create 640 root root
    sharedscripts
    postrotate
        /etc/init.d/syslog reload
    endscript
}

Run logrotate -d /etc/logrotate.conf to check (no changes are made, just for debugging).

Force logrotate to do its job: logrotate -fv /etc/logrotate.conf

Also have a look in /var/lib/logrotate/status (location might be different)

newFreeBSD · 09-08-2013, 11:44 PM

Quote:

Originally Posted by druuna

This should work:

Code:

/var/log/firewall {
    rotate 10
    size 1024M
    compress
    create 640 root root
    sharedscripts
    postrotate
        /etc/init.d/syslog reload
    endscript
}

Run logrotate -d /etc/logrotate.conf to check (no changes are made, just for debugging).

Force logrotate to do its job: logrotate -fv /etc/logrotate.conf

Also have a look in /var/lib/logrotate/status (location might be different)

This config not working also. Check this morning. File exceed to be more than 1GB. I do config for 10MB per file. For 10M that i make confid, is that compress file or file before compress?

Thanks.

druuna · 09-09-2013, 01:34 AM

Quote:

Originally Posted by newFreeBSD

This config not working also. Check this morning. File exceed to be more than 1GB.

Can you post the output of the commands I mentioned in post #6. Also include the output of the following command (before and after running the other 2 commands):

Code:

ls -l /var/log/firewall*

Quote:

I do config for 10MB per file. For 10M that i make confid, is that compress file or file before compress?

The compress option is used after the file is rotated (file >= 1024M --> rotate --> compress rotated file).

Have a look here for details: Manage Linux log files with Logrotate

newFreeBSD · 09-10-2013, 08:05 PM

I try new comfig:

Code:

/var/log/firewall {
    
    rotate 15
    dateext
    size 102M
    compress
    create 644 root root
    sharedscripts
    postrotate
        /etc/init.d/syslog reload
    endscript
}

I'll check this morning and firewall goes to 3.2GB. What i miss? How to rotate daily and rotate about 15 plus compress?

Thanks.

druuna · 09-11-2013, 02:27 AM

If you don't answer the questions that are asked, we aren't able to help.

Repeating the same question with a different configuration and the same result is rather pointless.

From post #8:

Quote:

Originally Posted by druuna

Can you post the output of the commands I mentioned in post #6. Also include the output of the following command (before and after running the other 2 commands):

Code:

ls -l /var/log/firewall*

From post #6:

Quote:

Originally Posted by druuna

Run logrotate -d /etc/logrotate.conf to check (no changes are made, just for debugging).

Force logrotate to do its job: logrotate -fv /etc/logrotate.conf

Also have a look in /var/lib/logrotate/status (location might be different)

newFreeBSD · 09-12-2013, 01:05 AM

Code:

reading config file /etc/logrotate.conf
compress_prog is now /usr/bin/bzip2
compress_ext was changed to .bz2
uncompress_prog is now /usr/bin/bunzip2
including /etc/logrotate.d
reading config file apache2
reading config info for /var/log/apache2/access_log 
reading config info for /var/log/apache2/error_log 
reading config info for /var/log/apache2/suexec.log 
reading config info for /var/log/apache2/ssl_request_log 
reading config info for /var/log/apache2/ssl_engine_log 
reading config file libvirtd
reading config info for /var/log/libvirt/qemu/*.log /var/log/libvirt/uml/*.log /var/log/libvirt/lxc/*.log 
reading config file mysql
reading config info for /var/lib/mysql/mysqld.log 
reading config file net-snmp
reading config info for /var/log/net-snmpd.log 
reading config file ntp
reading config info for /var/log/ntp 
reading config file openslp-server
reading config info for /var/log/slpd.log 
reading config file rsync
reading config info for /var/log/rsyncd.log 
reading config file samba
reading config info for /var/log/samba/log.nmbd 
reading config info for /var/log/samba/log.smbd 
reading config file scpm
reading config info for /var/log/scpm 
reading config file scrollkeeper
reading config info for /var/log/scrollkeeper.log 
reading config file syslog
reading config info for /var/log/warn /var/log/messages /var/log/allmessages /var/log/localmessages /var/log/acpid /var/log/NetworkManager 
reading config info for /var/log/mail /var/log/mail.info /var/log/mail.warn /var/log/mail.err 
reading config info for /var/log/news/news.crit /var/log/news/news.err /var/log/news/news.notice 
reading config info for /var/log/firewall 
reading config file vsftpd
reading config info for /var/log/vsftpd.log 
reading config file wtmp
reading config info for /var/log/wtmp 
reading config file xdm
reading config info for /var/log/xdm.errors 
reading config file xen
reading config info for /var/log/xen/xend*.log 
reading config info for /var/log/xen/domain-builder-ng.log /var/log/xen/xen-hotplug.log 
reading config info for /var/log/xen/qemu-dm.*.log 
reading config file xinetd
reading config info for /var/log/xinetd.log 
reading config file zypp-history.lr
reading config info for /var/log/zypp/history 
reading config file zypp-refresh.lr
reading config info for /var/log/zypp-refresh.log 
reading config file zypper.lr
reading config info for /var/log/zypper.log 

Handling 29 logs

rotating pattern: /var/log/apache2/access_log  4194304 bytes (5 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/apache2/access_log
  log does not need rotating
not running postrotate script, since no logs were rotated

rotating pattern: /var/log/apache2/error_log  1048576 bytes (5 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/apache2/error_log
  log needs rotating
rotating log /var/log/apache2/error_log, log->rotateCount is 5
dateext suffix '-20130912'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
error: destination /var/log/apache2/error_log-20130912.bz2 already exists, skipping rotation

rotating pattern: /var/log/apache2/suexec.log  1048576 bytes (99 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/apache2/suexec.log
  log /var/log/apache2/suexec.log does not exist -- skipping
not running postrotate script, since no logs were rotated

rotating pattern: /var/log/apache2/ssl_request_log  4194304 bytes (99 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/apache2/ssl_request_log
  log /var/log/apache2/ssl_request_log does not exist -- skipping
not running postrotate script, since no logs were rotated

rotating pattern: /var/log/apache2/ssl_engine_log  1048576 bytes (99 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/apache2/ssl_engine_log
  log /var/log/apache2/ssl_engine_log does not exist -- skipping
not running postrotate script, since no logs were rotated

rotating pattern: /var/log/libvirt/qemu/*.log /var/log/libvirt/uml/*.log /var/log/libvirt/lxc/*.log  weekly (4 rotations)
empty log files are rotated, only log files >= 102400 bytes are rotated, old logs are removed
considering log /var/log/libvirt/qemu/*.log
  log /var/log/libvirt/qemu/*.log does not exist -- skipping
considering log /var/log/libvirt/uml/*.log
  log /var/log/libvirt/uml/*.log does not exist -- skipping
considering log /var/log/libvirt/lxc/*.log
  log /var/log/libvirt/lxc/*.log does not exist -- skipping

rotating pattern: /var/lib/mysql/mysqld.log  after 1 days (3 rotations)
empty log files are not rotated, old logs are removed
considering log /var/lib/mysql/mysqld.log
  log /var/lib/mysql/mysqld.log does not exist -- skipping
not running postrotate script, since no logs were rotated

rotating pattern: /var/log/net-snmpd.log  1048576 bytes (99 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/net-snmpd.log
  log /var/log/net-snmpd.log does not exist -- skipping
not running postrotate script, since no logs were rotated

rotating pattern: /var/log/ntp  2097152 bytes (99 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/ntp
  log does not need rotating
not running postrotate script, since no logs were rotated

rotating pattern: /var/log/slpd.log  1048576 bytes (99 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/slpd.log
  log /var/log/slpd.log does not exist -- skipping
not running postrotate script, since no logs were rotated

rotating pattern: /var/log/rsyncd.log  1048576 bytes (99 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/rsyncd.log
  log /var/log/rsyncd.log does not exist -- skipping

rotating pattern: /var/log/samba/log.nmbd  1048576 bytes (99 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/samba/log.nmbd
  log does not need rotating

rotating pattern: /var/log/samba/log.smbd  1048576 bytes (99 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/samba/log.smbd
  log does not need rotating

rotating pattern: /var/log/scpm  1048576 bytes (1 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/scpm
  log does not need rotating

rotating pattern: /var/log/scrollkeeper.log  4194304 bytes (99 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/scrollkeeper.log
  log /var/log/scrollkeeper.log does not exist -- skipping

rotating pattern: /var/log/warn /var/log/messages /var/log/allmessages /var/log/localmessages /var/log/acpid /var/log/NetworkManager  5242880 bytes (20 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/warn
  log does not need rotating
considering log /var/log/messages
  log does not need rotating
considering log /var/log/allmessages
  log /var/log/allmessages does not exist -- skipping
considering log /var/log/localmessages
  log does not need rotating
considering log /var/log/acpid
  log does not need rotating
considering log /var/log/NetworkManager
  log does not need rotating
not running postrotate script, since no logs were rotated

rotating pattern: /var/log/mail /var/log/mail.info /var/log/mail.warn /var/log/mail.err  4194304 bytes (99 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/mail
  log does not need rotating
considering log /var/log/mail.info
  log does not need rotating
considering log /var/log/mail.warn
  log does not need rotating
considering log /var/log/mail.err
  log does not need rotating
not running postrotate script, since no logs were rotated

rotating pattern: /var/log/news/news.crit /var/log/news/news.err /var/log/news/news.notice  4194304 bytes (99 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/news/news.crit
  log does not need rotating
considering log /var/log/news/news.err
  log does not need rotating
considering log /var/log/news/news.notice
  log does not need rotating
not running postrotate script, since no logs were rotated

rotating pattern: /var/log/firewall  after 1 days (15 rotations)
empty log files are rotated, old logs are removed
considering log /var/log/firewall
  log does not need rotating
not running postrotate script, since no logs were rotated

rotating pattern: /var/log/vsftpd.log  1048576 bytes (99 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/vsftpd.log
  log /var/log/vsftpd.log does not exist -- skipping
not running postrotate script, since no logs were rotated

rotating pattern: /var/log/wtmp  409600 bytes (99 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/wtmp
  log does not need rotating

rotating pattern: /var/log/xdm.errors  4194304 bytes (99 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/xdm.errors
  log /var/log/xdm.errors does not exist -- skipping

rotating pattern: /var/log/xen/xend*.log  1048576 bytes (5 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/xen/xend-debug.log
  log does not need rotating
considering log /var/log/xen/xend.log
  log does not need rotating

rotating pattern: /var/log/xen/domain-builder-ng.log /var/log/xen/xen-hotplug.log  102400 bytes (2 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/xen/domain-builder-ng.log
  log does not need rotating
considering log /var/log/xen/xen-hotplug.log
  log does not need rotating

rotating pattern: /var/log/xen/qemu-dm.*.log  monthly (no old logs will be kept)
empty log files are rotated, old logs are removed
considering log /var/log/xen/qemu-dm.*.log
  log /var/log/xen/qemu-dm.*.log does not exist -- skipping

rotating pattern: /var/log/xinetd.log  2097152 bytes (99 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/xinetd.log
  log does not need rotating
not running postrotate script, since no logs were rotated

rotating pattern: /var/log/zypp/history  10485760 bytes (99 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/zypp/history
  log /var/log/zypp/history does not exist -- skipping

rotating pattern: /var/log/zypp-refresh.log  10485760 bytes (99 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/zypp-refresh.log
  log /var/log/zypp-refresh.log does not exist -- skipping

rotating pattern: /var/log/zypper.log  10485760 bytes (99 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/zypper.log
  log /var/log/zypper.log does not exist -- skipping
svr-crapp2:~ # 
svr-crapp2:~ #

Code:

svr-crapp2:~ # logrotate -fv /etc/logrotate.conf
reading config file /etc/logrotate.conf
compress_prog is now /usr/bin/bzip2
compress_ext was changed to .bz2
uncompress_prog is now /usr/bin/bunzip2
including /etc/logrotate.d
reading config file apache2
reading config info for /var/log/apache2/access_log 
reading config info for /var/log/apache2/error_log 
reading config info for /var/log/apache2/suexec.log 
reading config info for /var/log/apache2/ssl_request_log 
reading config info for /var/log/apache2/ssl_engine_log 
reading config file libvirtd
reading config info for /var/log/libvirt/qemu/*.log /var/log/libvirt/uml/*.log /var/log/libvirt/lxc/*.log 
reading config file mysql
reading config info for /var/lib/mysql/mysqld.log 
reading config file net-snmp
reading config info for /var/log/net-snmpd.log 
reading config file ntp
reading config info for /var/log/ntp 
reading config file openslp-server
reading config info for /var/log/slpd.log 
reading config file rsync
reading config info for /var/log/rsyncd.log 
reading config file samba
reading config info for /var/log/samba/log.nmbd 
reading config info for /var/log/samba/log.smbd 
reading config file scpm
reading config info for /var/log/scpm 
reading config file scrollkeeper
reading config info for /var/log/scrollkeeper.log 
reading config file syslog
reading config info for /var/log/warn /var/log/messages /var/log/allmessages /var/log/localmessages /var/log/acpid /var/log/NetworkManager 
reading config info for /var/log/mail /var/log/mail.info /var/log/mail.warn /var/log/mail.err 
reading config info for /var/log/news/news.crit /var/log/news/news.err /var/log/news/news.notice 
reading config info for /var/log/firewall 
reading config file vsftpd
reading config info for /var/log/vsftpd.log 
reading config file wtmp
reading config info for /var/log/wtmp 
reading config file xdm
reading config info for /var/log/xdm.errors 
reading config file xen
reading config info for /var/log/xen/xend*.log 
reading config info for /var/log/xen/domain-builder-ng.log /var/log/xen/xen-hotplug.log 
reading config info for /var/log/xen/qemu-dm.*.log 
reading config file xinetd
reading config info for /var/log/xinetd.log 
reading config file zypp-history.lr
reading config info for /var/log/zypp/history 
reading config file zypp-refresh.lr
reading config info for /var/log/zypp-refresh.log 
reading config file zypper.lr
reading config info for /var/log/zypper.log 

Handling 29 logs

rotating pattern: /var/log/apache2/access_log  forced from command line (5 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/apache2/access_log
  log needs rotating
rotating log /var/log/apache2/access_log, log->rotateCount is 5
dateext suffix '-20130912'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
error: destination /var/log/apache2/access_log-20130912.bz2 already exists, skipping rotation

rotating pattern: /var/log/apache2/error_log  forced from command line (5 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/apache2/error_log
  log needs rotating
rotating log /var/log/apache2/error_log, log->rotateCount is 5
dateext suffix '-20130912'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
error: destination /var/log/apache2/error_log-20130912.bz2 already exists, skipping rotation

rotating pattern: /var/log/apache2/suexec.log  forced from command line (99 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/apache2/suexec.log
  log /var/log/apache2/suexec.log does not exist -- skipping
not running postrotate script, since no logs were rotated

rotating pattern: /var/log/apache2/ssl_request_log  forced from command line (99 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/apache2/ssl_request_log
  log /var/log/apache2/ssl_request_log does not exist -- skipping
not running postrotate script, since no logs were rotated

rotating pattern: /var/log/apache2/ssl_engine_log  forced from command line (99 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/apache2/ssl_engine_log
  log /var/log/apache2/ssl_engine_log does not exist -- skipping
not running postrotate script, since no logs were rotated

rotating pattern: /var/log/libvirt/qemu/*.log /var/log/libvirt/uml/*.log /var/log/libvirt/lxc/*.log  forced from command line (4 rotations)
empty log files are rotated, only log files >= 102400 bytes are rotated, old logs are removed
considering log /var/log/libvirt/qemu/*.log
  log /var/log/libvirt/qemu/*.log does not exist -- skipping
considering log /var/log/libvirt/uml/*.log
  log /var/log/libvirt/uml/*.log does not exist -- skipping
considering log /var/log/libvirt/lxc/*.log
  log /var/log/libvirt/lxc/*.log does not exist -- skipping

rotating pattern: /var/lib/mysql/mysqld.log  forced from command line (3 rotations)
empty log files are not rotated, old logs are removed
considering log /var/lib/mysql/mysqld.log
  log /var/lib/mysql/mysqld.log does not exist -- skipping
not running postrotate script, since no logs were rotated

rotating pattern: /var/log/net-snmpd.log  forced from command line (99 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/net-snmpd.log
  log /var/log/net-snmpd.log does not exist -- skipping
not running postrotate script, since no logs were rotated

rotating pattern: /var/log/ntp  forced from command line (99 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/ntp
  log needs rotating
rotating log /var/log/ntp, log->rotateCount is 99
dateext suffix '-20130912'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
error: destination /var/log/ntp-20130912.bz2 already exists, skipping rotation

rotating pattern: /var/log/slpd.log  forced from command line (99 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/slpd.log
  log /var/log/slpd.log does not exist -- skipping
not running postrotate script, since no logs were rotated

rotating pattern: /var/log/rsyncd.log  forced from command line (99 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/rsyncd.log
  log /var/log/rsyncd.log does not exist -- skipping

rotating pattern: /var/log/samba/log.nmbd  forced from command line (99 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/samba/log.nmbd
  log does not need rotating

rotating pattern: /var/log/samba/log.smbd  forced from command line (99 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/samba/log.smbd
  log does not need rotating

rotating pattern: /var/log/scpm  forced from command line (1 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/scpm
  log does not need rotating

rotating pattern: /var/log/scrollkeeper.log  forced from command line (99 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/scrollkeeper.log
  log /var/log/scrollkeeper.log does not exist -- skipping

rotating pattern: /var/log/warn /var/log/messages /var/log/allmessages /var/log/localmessages /var/log/acpid /var/log/NetworkManager  forced from command line (20 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/warn
  log needs rotating
considering log /var/log/messages
  log needs rotating
considering log /var/log/allmessages
  log /var/log/allmessages does not exist -- skipping
considering log /var/log/localmessages
  log does not need rotating
considering log /var/log/acpid
  log does not need rotating
considering log /var/log/NetworkManager
  log does not need rotating
rotating log /var/log/warn, log->rotateCount is 20
dateext suffix '-20130912'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
error: destination /var/log/warn-20130912.bz2 already exists, skipping rotation
rotating log /var/log/messages, log->rotateCount is 20
dateext suffix '-20130912'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
error: destination /var/log/messages-20130912.bz2 already exists, skipping rotation

rotating pattern: /var/log/mail /var/log/mail.info /var/log/mail.warn /var/log/mail.err  forced from command line (99 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/mail
  log does not need rotating
considering log /var/log/mail.info
  log does not need rotating
considering log /var/log/mail.warn
  log does not need rotating
considering log /var/log/mail.err
  log does not need rotating
not running postrotate script, since no logs were rotated

rotating pattern: /var/log/news/news.crit /var/log/news/news.err /var/log/news/news.notice  forced from command line (99 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/news/news.crit
  log does not need rotating
considering log /var/log/news/news.err
  log does not need rotating
considering log /var/log/news/news.notice
  log does not need rotating
not running postrotate script, since no logs were rotated

rotating pattern: /var/log/firewall  forced from command line (15 rotations)
empty log files are rotated, old logs are removed
considering log /var/log/firewall
  log needs rotating
rotating log /var/log/firewall, log->rotateCount is 15
dateext suffix '-20130912'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
renaming /var/log/firewall to /var/log/firewall-20130912
creating new /var/log/firewall mode = 0644 uid = 0 gid = 0
running postrotate script
Reload syslog service                                                done
compressing log with: /usr/bin/bzip2

rotating pattern: /var/log/vsftpd.log  forced from command line (99 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/vsftpd.log
  log /var/log/vsftpd.log does not exist -- skipping
not running postrotate script, since no logs were rotated

rotating pattern: /var/log/wtmp  forced from command line (99 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/wtmp
  log needs rotating
rotating log /var/log/wtmp, log->rotateCount is 99
dateext suffix '-20130912'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
error: destination /var/log/wtmp-20130912.bz2 already exists, skipping rotation

rotating pattern: /var/log/xdm.errors  forced from command line (99 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/xdm.errors
  log /var/log/xdm.errors does not exist -- skipping

rotating pattern: /var/log/xen/xend*.log  forced from command line (5 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/xen/xend-debug.log
  log does not need rotating
considering log /var/log/xen/xend.log
  log does not need rotating

rotating pattern: /var/log/xen/domain-builder-ng.log /var/log/xen/xen-hotplug.log  forced from command line (2 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/xen/domain-builder-ng.log
  log does not need rotating
considering log /var/log/xen/xen-hotplug.log
  log does not need rotating

rotating pattern: /var/log/xen/qemu-dm.*.log  forced from command line (no old logs will be kept)
empty log files are rotated, old logs are removed
considering log /var/log/xen/qemu-dm.*.log
  log /var/log/xen/qemu-dm.*.log does not exist -- skipping

rotating pattern: /var/log/xinetd.log  forced from command line (99 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/xinetd.log
  log does not need rotating
not running postrotate script, since no logs were rotated

rotating pattern: /var/log/zypp/history  forced from command line (99 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/zypp/history
  log /var/log/zypp/history does not exist -- skipping

rotating pattern: /var/log/zypp-refresh.log  forced from command line (99 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/zypp-refresh.log
  log /var/log/zypp-refresh.log does not exist -- skipping

rotating pattern: /var/log/zypper.log  forced from command line (99 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/zypper.log
  log /var/log/zypper.log does not exist -- skipping
svr-crapp2:~ #

newFreeBSD · 09-12-2013, 01:07 AM

Code:

vr-crapp2:~ # ls -al /var/log/firewall*
-rw-rw-r-- 1 root root 21027878 Sep 12 14:06 /var/log/firewall
-rw-r--r-- 1 root root 32541138 Sep  3 07:21 /var/log/firewall-09032013.tar.gz
-rw-rw-r-- 1 root root 13952650 Sep  2 20:32 /var/log/firewall-20130902.bz2
-rw-rw-r-- 1 root root 27447956 Sep  3 20:34 /var/log/firewall-20130903.bz2
-rw-rw-r-- 1 root root  9801916 Sep  4 20:31 /var/log/firewall-20130904.bz2
-rw-rw-r-- 1 root root 15317494 Sep  5 20:32 /var/log/firewall-20130905.bz2
-rw-rw-r-- 1 root root 11534626 Sep  6 20:31 /var/log/firewall-20130906.bz2
-rw-rw-r-- 1 root root 17573734 Sep  7 20:32 /var/log/firewall-20130907.bz2
-rw-rw-r-- 1 root root 42941024 Sep  8 20:36 /var/log/firewall-20130908.bz2
-rw-rw-r-- 1 root root    22812 Sep  9 20:23 /var/log/firewall-20130909.bz2
-rw-rw-r-- 1 root root  3793092 Sep 10 13:56 /var/log/firewall-20130910.bz2
-rw-rw-r-- 1 root root   682273 Sep 11 09:17 /var/log/firewall-20130911.bz2
-rw-rw-r-- 1 root root  4999862 Sep 12 14:03 /var/log/firewall-20130912.bz2
-rw-rw-r-- 1 root root   447661 Sep 12 09:11 /var/log/firewall-20130912_1.bz2
-rw-r--r-- 1 root root        0 Jun 27 11:32 /var/log/firewall.log
svr-crapp2:~ #

druuna · 09-12-2013, 01:42 AM

I don't see anything suspicious in the above (except this entry: firewall-09032013.tar.gz: strange date format and not a bz2 file).

I hope you realize the following: Logrotate checks once a day. It is not a process that runs 24/7. What this means is that your firewall file might become (much) larger then the set size in the logrotate configuration file during that period.

My advise at this time: go back to the "original" configuration for the firewall (post #4 or post #6), clean up the current compressed firewall files (back them up, move them to a safe location) and wait for a few days. I would check the size of the firewall log file during the day to get an indication of its size (a small script could do this for you).

newFreeBSD · 09-12-2013, 08:59 PM

Using config post#6. This is result:

Code:

banie@svr-crapp2:~> ls -l /var/log/firewall*
-rw-rw-r-- 1 root root          0 2013-09-13 00:00 /var/log/firewall
-rw-r--r-- 1 root root   32541138 2013-09-03 07:21 /var/log/firewall-09032013.tar.gz
-rw-rw-r-- 1 root root   13952650 2013-09-02 20:32 /var/log/firewall-20130902.bz2
-rw-rw-r-- 1 root root   27447956 2013-09-03 20:34 /var/log/firewall-20130903.bz2
-rw-rw-r-- 1 root root    9801916 2013-09-04 20:31 /var/log/firewall-20130904.bz2
-rw-rw-r-- 1 root root   15317494 2013-09-05 20:32 /var/log/firewall-20130905.bz2
-rw-rw-r-- 1 root root   11534626 2013-09-06 20:31 /var/log/firewall-20130906.bz2
-rw-rw-r-- 1 root root   17573734 2013-09-07 20:32 /var/log/firewall-20130907.bz2
-rw-rw-r-- 1 root root   42941024 2013-09-08 20:36 /var/log/firewall-20130908.bz2
-rw-rw-r-- 1 root root      22812 2013-09-09 20:23 /var/log/firewall-20130909.bz2
-rw-rw-r-- 1 root root    3793092 2013-09-10 13:56 /var/log/firewall-20130910.bz2
-rw-rw-r-- 1 root root     682273 2013-09-11 09:17 /var/log/firewall-20130911.bz2
-rw-rw-r-- 1 root root     447661 2013-09-12 09:11 /var/log/firewall-20130912_1.bz2
-rw-rw-r-- 1 root root    4999862 2013-09-12 14:03 /var/log/firewall-20130912.bz2
-rw-rw-r-- 1 root root 3179311104 2013-09-13 00:00 /var/log/firewall-20130913
-rw-rw-r-- 1 root root          0 2013-09-13 00:00 /var/log/firewall-20130913.bz2
-rw-r--r-- 1 root root          0 2013-06-27 11:32 /var/log/firewall.log
banie@svr-crapp2:~>

Seem not follow config. This is the problem. Syslog not working or wrong config?