logrotate ALERT and lastlog really big

[manarak]

Hi

in my messages log, it tells me:

logrotate ALERT existed abnormally with [1]

plus, my lastlog is really big.

what should I check?

 

[ShadowMan@]

Check for any log files which have grown too big (over 2 GB?) in size.

 

[manarak]

I checked the contents of var/log and there are no really large logs, except lastlog with 19MB.

 

[ShadowMan@]

What about the other log locations:

/usr/local/psa/var/log
/home/httpd/vhosts/domain.tld/statistics/logs

Also, do you have your /tmp set for noexec? If so, then you may want to check out this info I found by googling:

As a quick fix, concerned users will need to edit
/etc/cron.daily/logrotate and assign TMPDIR to a partition that is not
mounted noexec; e.g. TMPDIR=/var/tmp; export TMPDIR

 

[manarak]

ok, will check the logs.
the tip about noexec could be it, I mounted /tmp as noexec.

will give feddback if this worked in the evening.

thank you

 

[manarak]

hmmmm...

Logs in stats dirs and psa dir are all ok.

I executed
/usr/sbin/logrotate /etc/logrotate.conf
and no error came up??

=> So I am still chasing the error.

It seems the lastlog is not being rotated at all (not even after I executed the above)
Where does one tell the server what logs to rotate?

 

[ShadowMan@]

Where does one tell the server what logs to rotate?

/etc/logwatch.conf

/etc/logrotate.d/*

/usr/local/psa/etc/logrotate.d/*

 

[manarak]

hmmm... probably my syslog logrotate job is failing because of /tmp being noexec.

I added export TMPDIR=/var/logtmp to longrotate.conf
and I added lastlog to my syslogs.

I then executed logrotate by hand.

But it seems nothing changed with the logs.

The server seems to be logging all the syslogs to <name of log>.1 (archived log 1) instead of logging to the plain logname file...

i.e.

messages has size 0, date is one week old
messages.1 has a big size and is still being updated.

I got this mess since I have upgraded!

 

[ShadowMan@]

Did you restart the syslog daemon/service?

Also check the values set in /etc/syslog.conf for what gets logged to where... something like:

*.info;mail.none;news.none;authpriv.none;cron.none     /var/log/messages

It may be silly, but have you checked the ownership and permissions on /var/log/messages ?