Issue Log anonymization not working

[iansen]

Server operating system version

Ubuntu 20.04.4 LTS

Plesk version and microupdate number

18.0.43

Hello,
I can't seem to get log anonymization to work.
It worked fine until the log rotation bug in the previous versions, but not anymore.
After I updated to 18.0.43 the logs have started rotating again, but the IPs are not anonymized any more.
I've tried toggling the feature on and off in server settings... but still nothing happens when the logs are rotated.
What can I check to see what the issue is?
Thanks,
George

 

[IgorG]

Try to enable anonymization with following CLI commands:

# plesk bin settings -s logrotate_anonymize_ips=true
# plesk sbin logrot_mng --system-logs --anonymize-ip=true
# for i in `plesk db -se "select domains.name from domains left join dom_param on domains.id=dom_param.dom_id left join log_rotation on dom_param.val=log_rotation.id where domains.htype='vrt_hst' and dom_param.param='logrotation_id' and log_rotation.turned_on='true'"`; do plesk bin domain --update $i -log-rotate true; done

and check how it goes on.

 

[iansen]

Sorry for the delay, but no difference. The IPs are still not anonymized. What else can I check?
Are there any CRON jobs that I might have deleted?
I have tried implementing this: https://support.plesk.com/hc/en-us/...rce-Plesk-to-rotate-logs-more-often-on-Linux-
and forcing rotation but still no luck.

 

[IgorG]

I would suggest you contact Plesk Support Team. They will check and fix the issue directly on your server.

 

[radugt]

Hello all,

Same symptom here on Plesk Obsidian 18.0.81 (Debian 13). "Anonymize IP addresses during log rotation and collecting of web statistics" was enabled in Tools & Settings > Server Settings, and `plesk db` showed logrotate_anonymize_ips = true. Logs rotated every night, but the rotated files still had full IP addresses, on every domain.

In my case the cause was that the logrotate files Plesk generates had not been rewritten after the option was enabled. A domain only gets the anonymization step when its file is written with the option on. You can check it with:

grep anonymize_ip /usr/local/psa/etc/logrotate.d/<domain>

If nothing is printed, the step is missing. With anonymization on, every section of the file contains:

postrotate
/opt/psa/admin/sbin/anonymize_ip --find-rotated-logs $*
endscript

What fixed it for the domains: Websites & Domains > <domain> > Logs > Log Rotation, then OK without changing anything. Plesk rewrote the file with the postrotate step, and the next rotation was anonymized: every IP in the newly rotated logs ends in 0. Enabling the server-wide option did not rewrite the existing files, so every domain has to be saved again. Logs rotated before the fix are not anonymized afterwards; they keep full IPs until rotation deletes them.

For the system logs (Apache, nginx, mail, fail2ban), the example in logrot_mng's own --help adds the same step:

plesk sbin logrot_mng --system-logs --anonymize-ip=true

Warning: on my server this command also deleted every rotated system log, printing "Failed to remove '...': Success. Continue." for each file although the files were really removed. It seems to happen because --rot-count defaults to -1. Adding -K (--keep-old-logs) should prevent it. The current logs and the rotation settings were not affected.

One more trap: each domain log exists twice, as hard links in /var/www/vhosts/system/<domain>/logs and in /var/www/vhosts/<domain>/logs. Deleting a log in only one of the two places does not delete its content.

 

[tessa67]

Hi @iansen and @radugt

the symptoms look the same, but the two cases aren't: iansen (Plesk 18.0.43, Ubuntu 20.04) has no confirmed cause yet, while radugt (Plesk 18.0.81, Debian 13) found his. So here are two separate paths. Replace anything in angle brackets with your own values. Run all commands as root.

The key point: the anonymization happens through a postrotate step in each domain's logrotate file (/usr/local/psa/etc/logrotate.d/<DOMAIN>). If that step is missing there, nothing ever gets anonymized, even with the global option switched on.

PART A - for iansen (Plesk 18.0.43, Ubuntu 20.04)
Status: cause NOT confirmed. Approach = diagnose, then decide.

Step A1 - Check the current state (read-only, changes nothing):

plesk db -Ne "select * from misc where param like '%anonymize%'"
ls -l /opt/psa/admin/sbin/anonymize_ip
grep -L anonymize_ip /usr/local/psa/etc/logrotate.d/*

- Option isn't "true": turn it on with

plesk bin settings -s logrotate_anonymize_ips=true

- anonymize_ip is missing (ls says: No such file): repair the panel, then run A1 again

plesk repair installation

- The grep lists files: go to A2 (radugt's cause applies).
- The grep lists nothing: the files are fine, go to A3.

Step A2 - Have the logrotate files rewritten (backup first):

cp -a /usr/local/psa/etc/logrotate.d /root/logrotate.d.bak-$(date +%F)
for d in $(plesk db -Ne "select domains.name from domains left join dom_param on domains.id=dom_param.dom_id left join log_rotation on dom_param.val=log_rotation.id where domains.htype='vrt_hst' and dom_param.param='logrotation_id' and log_rotation.turned_on='true'"); do plesk bin domain --update "$d" -log-rotate true; done
grep -L anonymize_ip /usr/local/psa/etc/logrotate.d/*

If some files still don't have anonymize_ip: for each domain, go to Websites & Domains > <DOMAIN> > Logs > Log Rotation and just click OK without changing anything (that's what rewrote the files for radugt). Then test as in B3.

Step A3 - The files are correct but nothing gets anonymized anyway:

logrotate -d -v /usr/local/psa/etc/logrotate.d/<DOMAIN>
tail -n 100 /var/log/plesk/panel.log
grep -rl logrot /etc/cron.d /etc/cron.daily /etc/systemd/system 2>/dev/null
systemctl list-timers | grep -i -E "logrot|plesk"

The dry run (-d) doesn't rotate anything, but it shows errors in the script and whether the postrotate step would actually run. The rest tells you whether rotation runs via a Plesk cron job or timer at all, and whether the panel log has any errors about anonymize_ip.

Step A4 - If A1 to A3 turn up nothing: contact Plesk support (as IgorG recommended) and send them the output of A1 and A3 plus the contents of /usr/local/psa/etc/logrotate.d/<DOMAIN>.


PART B - for radugt's case (Plesk 18.0.81, Debian 13)
Status: cause and fix confirmed by radugt.

Step B1 - Find out which domains are missing the step (read-only):

grep -L anonymize_ip /usr/local/psa/etc/logrotate.d/*

Step B2 - Get the files rewritten. The confirmed way: for each domain, go to Websites & Domains > <DOMAIN> > Logs > Log Rotation and click OK, changing nothing. Switching the option on server-wide does NOT rewrite existing files, so you have to do each domain individually. CLI alternative (from the thread, not confirmed in this case):

cp -a /usr/local/psa/etc/logrotate.d /root/logrotate.d.bak-$(date +%F)
for d in $(plesk db -Ne "select domains.name from domains left join dom_param on domains.id=dom_param.dom_id left join log_rotation on dom_param.val=log_rotation.id where domains.htype='vrt_hst' and dom_param.param='logrotation_id' and log_rotation.turned_on='true'"); do plesk bin domain --update "$d" -log-rotate true; done

Step B3 - Check and do a test rotation:

grep -A2 postrotate /usr/local/psa/etc/logrotate.d/<DOMAIN>
logrotate -f /usr/local/psa/etc/logrotate.d/<DOMAIN>
ls -l /var/www/vhosts/system/<DOMAIN>/logs/
zcat -f /var/www/vhosts/system/<DOMAIN>/logs/<ROTATED_LOGFILE> | head -n 5

What you should see: the line "anonymize_ip --find-rotated-logs" in the postrotate block, and in the freshly rotated file the IPs end in 0. Logs rotated before anonymization was working stay as they are until rotation deletes them.

Step B4 - System logs (Apache, nginx, mail, fail2ban). WARNING: without -K, this command deleted all rotated system logs for radugt (it printed "Failed to remove ...: Success. Continue." even though it really did delete them). Suspected cause: --rot-count defaults to -1. So check your disk space and make a backup first, then run it with -K:

du -sh /var/log
cp -a /var/log /root/var-log.bak-$(date +%F)
plesk sbin logrot_mng --help
plesk sbin logrot_mng --system-logs --anonymize-ip=true -K

That -K prevents the deletion is just an assumption based on the logrot_mng help text and hasn't been tested, which is why the backup is there.

Note on hardlinks: every domain log exists twice, under /var/www/vhosts/system/<DOMAIN>/logs and /var/www/vhosts/<DOMAIN>/logs. The content is only really gone once the file is deleted in both places.

Regards
Tessa