Issue Lots of uncompressed log files generated

[matrix]

Server operating system version

Debian 12.7

Plesk version and microupdate number

18.0.64

Hello, I'm having a weird problem. I have correctly set logrotate to keep latest 30 days of logs and rotate daily.
Everything is working and everyday a new log_name.[number].gz is created.
However ONLY for 3 domain (out of over 200) i also get an uncompressed version of them named like this in the logs directory:

/var/www/vhosts/domain.com/logs/access_ssl_log.2024_08_29
/var/www/vhosts/domain.com/logs/access_ssl_log.2024_08_31
/var/www/vhosts/domain.com/logs/access_ssl_log.2024_08_30
/var/www/vhosts/domain.com/logs/access_ssl_log.2024_08_31.01
/var/www/vhosts/domain.com/logs/access_ssl_log.2024_08_31.02
/var/www/vhosts/domain.com/logs/access_ssl_log.2024_08_31.03
/var/www/vhosts/domain.com/logs/access_ssl_log.2024_09_16
/var/www/vhosts/domain.com/logs/access_ssl_log.2024_09_18

Even if I delete them they get recreated at next run.
I already tried to delete them from both the vhosts/system and vhosts/domain.com location.
I have no clue what is generating them. The logrotate and domain config is the same as all the other 200 domains on the same server that don't have this issue.
Any clue?

 

[Maarten]

It looks like you have a couple of locked subscriptions. That can be the reason why the logrotate is not working as expected.
Have a look at this article:

https://support.plesk.com/hc/en-us/articles/12377770549015-How-to-synchronize-locked-subscriptions-with-their-service-plans

 

[matrix]

It looks like you have a couple of locked subscriptions. That can be the reason why the logrotate is not working as expected.
Have a look at this article:

https://support.plesk.com/hc/en-us/articles/12377770549015-How-to-synchronize-locked-subscriptions-with-their-service-plans

No, they are unlocked and synchronized.
Also I don't get why a locked subs shouldn't rotate logs correctly anyway. In fact, they are rotated correctly. But it leaves the uncompressed ones renamed with the date.

 

[Maarten]

I recommend contacting Plesk Support so they can investigate the issue directly on your server.

To sign in for support, visit: Plesk Support

If you purchased your license through a reseller, they should provide support for you.

In case your reseller doesn’t offer support, Plesk provides an alternative with a free first month. You can find more details here: Plesk Support Offer

 

[matrix]

Can you just tell me which plesk script file is involved in the statistics cron or rotating logs? I'll fix it myself. Because those are not generated by logrotate, I already checked by running it manually.

 

[Maarten]

I've found this article which describes your issue:

https://support.plesk.com/hc/en-us/articles/12377289447191-Log-rotation-is-not-working-for-a-particular-domain-while-works-correctly-for-others

 

[matrix]

No, this is not my issue.
All the domains are correctly configured for logrotate. the logrotate config in /opt/PSA are correct too. logrotate DOES work correctly.
it's some other plesk script creating those files. those are not normal system log files. it's plesk creating them. I just need to find which script is doing that. probably something related to plesk disk usage statistics.

 

[mow]

fail2ban maybe?

 

[matrix]

fail2ban maybe?

no they are webserver access_logs

 

[Sebahat.hadzhi]

I tried to dig into our sources and , unfortunately, I was unable to find any relevant information for such a behavior. if you have a chance, please get in touch with our support so they can connect to the server and investigate that issue.

 

[matrix]

I tried to dig into our sources and , unfortunately, I was unable to find any relevant information for such a behavior. if you have a chance, please get in touch with our support so they can connect to the server and investigate that issue.

Isn't there anything in the source tha appends the files date to the logs? Maybe finding who adds the .2024_08_29 part will help.
Also, I'm using Litespeed Pro as webserver. But it's configured to use Apache logs files by default, so it shouldn't matter.