1. Please take a little time for this simple survey! Thank you for participating!
    Dismiss Notice

logrotate ALERT and lastlog really big

Discussion in 'Plesk for Linux - 8.x and Older' started by manarak, Nov 7, 2005.

  1. manarak

    manarak Guest


    in my messages log, it tells me:

    logrotate ALERT existed abnormally with [1]

    plus, my lastlog is really big.

    what should I check?
  2. ShadowMan@

    ShadowMan@ Guest

    Check for any log files which have grown too big (over 2 GB?) in size.
  3. manarak

    manarak Guest

    I checked the contents of var/log and there are no really large logs, except lastlog with 19MB.
  4. ShadowMan@

    ShadowMan@ Guest

    What about the other log locations:


    Also, do you have your /tmp set for noexec? If so, then you may want to check out this info I found by googling:
  5. manarak

    manarak Guest

    ok, will check the logs.
    the tip about noexec could be it, I mounted /tmp as noexec.

    will give feddback if this worked in the evening.

    thank you
  6. manarak

    manarak Guest


    Logs in stats dirs and psa dir are all ok.

    I executed
    /usr/sbin/logrotate /etc/logrotate.conf
    and no error came up??

    => So I am still chasing the error.

    It seems the lastlog is not being rotated at all (not even after I executed the above)
    Where does one tell the server what logs to rotate?
  7. ShadowMan@

    ShadowMan@ Guest



  8. manarak

    manarak Guest

    hmmm... probably my syslog logrotate job is failing because of /tmp being noexec.

    I added export TMPDIR=/var/logtmp to longrotate.conf
    and I added lastlog to my syslogs.

    I then executed logrotate by hand.

    But it seems nothing changed with the logs.

    The server seems to be logging all the syslogs to <name of log>.1 (archived log 1) instead of logging to the plain logname file...


    messages has size 0, date is one week old
    messages.1 has a big size and is still being updated.

    I got this mess since I have upgraded!
  9. ShadowMan@

    ShadowMan@ Guest

    Did you restart the syslog daemon/service?

    Also check the values set in /etc/syslog.conf for what gets logged to where... something like:

    *.info;mail.none;news.none;authpriv.none;cron.none     /var/log/messages
    It may be silly, but have you checked the ownership and permissions on /var/log/messages ?