Issue Rotation of access_ssl_log.webstat can be done, but previous access_ssl_log.webstat is restored on next day

[Bitpalast]

Server operating system version

Alma 8

Plesk version and microupdate number

18.0.68 #2

In a subscription /logs/access_ssl_log.webstat has grown to a large size where the nightly AWStats maintenance starts hanging. The only solution we could find was to remove the access_ssl_log.webstat file so that further processing by AWStats is done with a much smaller file. As AWStats stores processed statistics in a separate file, the .webstat log file could be removed (or rotated) without consequences.

So we rotated it. But on the next day, the original access_ssl_log.webstat file is restored and continued with current data. Where does it come from?

I already checked whether it is a hard or soft linked file from /var/www/vhosts/system/*domain*/logs, but could not find it there.

Where does the system take the copy from to restore the file to /var/www/vhosts/*domain*/logs if not from the system directory? How can the file be rotated properly?

 

[Sebahat.hadzhi]

Hello, Peter. I am not sure if you checked this already, but could incorrect formatting be the issue in you case too?

As for the files being restored, as far as I am aware this is a result of Plesk's daily maintenance and statistics collection tasks /usr/local/psa/bin/sw-engine-pleskrun /usr/local/psa/admin/plib/DailyMaintainance/script.php -f ExecuteStatistics. However, the behavior is only observed when the hardlink is present in the /var/www/vhosts/system/domain.com/logs folder. Could you please double-check if you haven't missed it by any chance? If you are certain the file's not there, I will double-check with our team what else could be causing the issue.

 

[Bitpalast]

Example:
/var/www/vhosts/system/<domainname>/logs has
-rw-r--r--. 1 root root 0 Mar 28 05:10 access_ssl_log.webstat

/var/www/vhosts/<domainname>/logs has
-rw-r--r--. 1 root root 21901421 Mar 28 03:31 access_ssl_log.webstat

However, when I rotate /var/www/vhosts/<domainname>/logs/access_ssl_log.webstat, rotation will work, but next morning the full old file sized about 20 MB is back. And I have no idea where that comes from, because it does not exist in the system directory.

Format of the logs are Plesk standards. The problem with AWStats hanging does not occur with small .webstat files or small access_ssl_log files. It only occurs when large .webstat files or access_ssl_log files exist, so that for some reason, the AWStats log file maintenance gets stuck. That won't be a problem here though. It's something I observed several times after the migration from CentOS to Alma, so it's probably Alma specific.

The problem is that I cannot remove or rotate the access_ssl_log.webstat file, because that is always restored during nightly maintenance.

 

[Sebahat.hadzhi]

Thank you for the confirmation. I believe it is recreated due the presence of the file under the system folder. However, its deletion might cause data loss. Let me double-check with our team on that and I will get back to you with further details.

 

[shg]

Hi Peter!

The two files are indeed hard-linked.

The only solution we could find was to remove the access_ssl_log.webstat file

This sounds like a problem.
If you first remove the file and then create a new, smaller or even empty one, this new file will get its own inode, for example:

ls -i /var/www/vhosts/example.com/logs/access_ssl_log.webstat
860061 /var/www/vhosts/example.com/logs/access_ssl_log.webstat
rm -f /var/www/vhosts/example.com/logs/access_ssl_log.webstat
echo "new things" > /var/www/example.com/logs/access_ssl_log.webstat
ls -i /var/www/vhosts/example.com/logs/access_ssl_log.webstat
860078 /var/www/vhosts/example.com/logs/access_ssl_log.webstat

And then Plesk thinks "Something is wrong here, let's recreate the hardlink" the next time it executes the statistics tasks.
If you just leave out the removal part, and instead only overwrite the existing file with "nothing", I would assume it should work as you expect, e.g.

echo "" > /var/www/example.com/logs/access_ssl_log.webstat

Greetings,

 

[shg]

Or as another idea, in order to not loose the statistics completely, you could maybe also try to truncate the file:

tail -n [a number of lines your server can still cope with] /var/www/vhosts/system/example.com/logs/access_ssl_log.webstat > tempfile
cat tempfile > /var/www/vhosts/example.com/logs/access_ssl_log.webstat

Because if you clear out the file completely, you might as well just disable the statistics for that domain.

 

[Amadex]

I have this problem too on CloudLinux 7 and 8.

I'm deleting 80gb webstat logs but they are coming back.