1. Please take a little time for this simple survey! Thank you for participating!
    Dismiss Notice
  2. Dear Pleskians, please read this carefully! New attachments and other rules Thank you!
    Dismiss Notice
  3. Dear Pleskians, I really hope that you will share your opinion in this Special topic for chatter about Plesk in the Clouds. Thank you!
    Dismiss Notice

logrotate ALERT and lastlog really big

Discussion in 'Plesk for Linux - 8.x and Older' started by manarak, Nov 7, 2005.

  1. manarak

    manarak Guest

    0
     
    Hi

    in my messages log, it tells me:

    logrotate ALERT existed abnormally with [1]

    plus, my lastlog is really big.

    what should I check?
     
  2. ShadowMan@

    ShadowMan@ Guest

    0
     
    Check for any log files which have grown too big (over 2 GB?) in size.
     
  3. manarak

    manarak Guest

    0
     
    I checked the contents of var/log and there are no really large logs, except lastlog with 19MB.
     
  4. ShadowMan@

    ShadowMan@ Guest

    0
     
    What about the other log locations:

    /usr/local/psa/var/log
    /home/httpd/vhosts/domain.tld/statistics/logs

    Also, do you have your /tmp set for noexec? If so, then you may want to check out this info I found by googling:
     
  5. manarak

    manarak Guest

    0
     
    ok, will check the logs.
    the tip about noexec could be it, I mounted /tmp as noexec.

    will give feddback if this worked in the evening.

    thank you
     
  6. manarak

    manarak Guest

    0
     
    hmmmm...

    Logs in stats dirs and psa dir are all ok.

    I executed
    /usr/sbin/logrotate /etc/logrotate.conf
    and no error came up??

    => So I am still chasing the error.

    It seems the lastlog is not being rotated at all (not even after I executed the above)
    Where does one tell the server what logs to rotate?
     
  7. ShadowMan@

    ShadowMan@ Guest

    0
     
    /etc/logwatch.conf

    /etc/logrotate.d/*

    /usr/local/psa/etc/logrotate.d/*
     
  8. manarak

    manarak Guest

    0
     
    hmmm... probably my syslog logrotate job is failing because of /tmp being noexec.

    I added export TMPDIR=/var/logtmp to longrotate.conf
    and I added lastlog to my syslogs.

    I then executed logrotate by hand.

    But it seems nothing changed with the logs.

    The server seems to be logging all the syslogs to <name of log>.1 (archived log 1) instead of logging to the plain logname file...

    i.e.

    messages has size 0, date is one week old
    messages.1 has a big size and is still being updated.

    I got this mess since I have upgraded!
     
  9. ShadowMan@

    ShadowMan@ Guest

    0
     
    Did you restart the syslog daemon/service?

    Also check the values set in /etc/syslog.conf for what gets logged to where... something like:

    Code:
    *.info;mail.none;news.none;authpriv.none;cron.none     /var/log/messages
    It may be silly, but have you checked the ownership and permissions on /var/log/messages ?
     
Loading...