1. Please take a little time for this simple survey! Thank you for participating!
    Dismiss Notice

logrotate ALERT and lastlog really big

Discussion in 'Plesk for Linux - 8.x and Older' started by manarak, Nov 7, 2005.

  1. manarak

    manarak Guest

    0
     
    Hi

    in my messages log, it tells me:

    logrotate ALERT existed abnormally with [1]

    plus, my lastlog is really big.

    what should I check?
     
  2. ShadowMan@

    ShadowMan@ Guest

    0
     
    Check for any log files which have grown too big (over 2 GB?) in size.
     
  3. manarak

    manarak Guest

    0
     
    I checked the contents of var/log and there are no really large logs, except lastlog with 19MB.
     
  4. ShadowMan@

    ShadowMan@ Guest

    0
     
    What about the other log locations:

    /usr/local/psa/var/log
    /home/httpd/vhosts/domain.tld/statistics/logs

    Also, do you have your /tmp set for noexec? If so, then you may want to check out this info I found by googling:
     
  5. manarak

    manarak Guest

    0
     
    ok, will check the logs.
    the tip about noexec could be it, I mounted /tmp as noexec.

    will give feddback if this worked in the evening.

    thank you
     
  6. manarak

    manarak Guest

    0
     
    hmmmm...

    Logs in stats dirs and psa dir are all ok.

    I executed
    /usr/sbin/logrotate /etc/logrotate.conf
    and no error came up??

    => So I am still chasing the error.

    It seems the lastlog is not being rotated at all (not even after I executed the above)
    Where does one tell the server what logs to rotate?
     
  7. ShadowMan@

    ShadowMan@ Guest

    0
     
    /etc/logwatch.conf

    /etc/logrotate.d/*

    /usr/local/psa/etc/logrotate.d/*
     
  8. manarak

    manarak Guest

    0
     
    hmmm... probably my syslog logrotate job is failing because of /tmp being noexec.

    I added export TMPDIR=/var/logtmp to longrotate.conf
    and I added lastlog to my syslogs.

    I then executed logrotate by hand.

    But it seems nothing changed with the logs.

    The server seems to be logging all the syslogs to <name of log>.1 (archived log 1) instead of logging to the plain logname file...

    i.e.

    messages has size 0, date is one week old
    messages.1 has a big size and is still being updated.

    I got this mess since I have upgraded!
     
  9. ShadowMan@

    ShadowMan@ Guest

    0
     
    Did you restart the syslog daemon/service?

    Also check the values set in /etc/syslog.conf for what gets logged to where... something like:

    Code:
    *.info;mail.none;news.none;authpriv.none;cron.none     /var/log/messages
    It may be silly, but have you checked the ownership and permissions on /var/log/messages ?
     
Loading...