2

Logrotate runs daily and emails me a report. This has been working fine however I now get the following email daily also:

Date: Mon, 10 Aug 2009 04:02:08 +0100 From: [email protected] (Cron Daemon) To: [email protected] Subject: Cron <root@dev> run-parts /etc/cron.daily Auto-Submitted: auto-generated X-Cron-Env: <SHELL=/bin/bash> X-Cron-Env: <PATH=/sbin:/bin:/usr/sbin:/usr/bin> X-Cron-Env: <MAILTO=root> X-Cron-Env: <HOME=/> X-Cron-Env: <LOGNAME=root> X-Cron-Env: <USER=root> /etc/cron.daily/logrotate: ERROR No file found for /var/log/apache*/*error.log ERROR No file found for /home/www/myhomepage/error.log ERROR No file found for /var/www/*/logs/access_log

The above log directories do not exist and I don't know why logrotate suddenly decided to include them. I think this problem started after I installed fail2ban.

/etc/cron.daily/logrotate contains:

#!/bin/sh /usr/sbin/logrotate /etc/logrotate.conf EXITVALUE=$? if [ $EXITVALUE != 0 ]; then /usr/bin/logger -t logrotate "ALERT exited abnormally with [$EXITVALUE]" fi exit 0

/etc/logrotate.conf contains:

# see "man logrotate" for details # rotate log files weekly weekly # keep 4 weeks worth of backlogs rotate 4 # create new (empty) log files after rotating old ones create # uncomment this if you want your log files compressed #compress # RPM packages drop log rotation information into this directory include /etc/logrotate.d # no packages own wtmp -- we'll rotate them here /var/log/wtmp { monthly minsize 1M create 0664 root utmp rotate 1 }

/etc/logrotate.d/httpd contains:

/var/log/httpd/*log { missingok notifempty sharedscripts postrotate /sbin/service httpd reload > /dev/null 2>/dev/null || true endscript }

I'm not sure where the reference to /var/log/apache*/error.log, /home/www/myhomepage/error.log or /var/www//logs/access_log is.

Any ideas?

Thanks, Patrick

EDIT Thanks for the responses, here's what I've tried:

vatican:~# grep myhomepage /etc/logrotate.d/* vatican:~# grep apache /etc/logrotate.d/* vatican:~# grep www /etc/logrotate.d/*

Nothing returned! This is strange!

EDIT Thanks again for the responses. The problem was after all caused by fail2ban. The references were made in the jail.conf file. I've corrected these references and the issue is resolved.

Improve this question
2
  • Try: grep apache /etc/logrotate.d/* to find any reference to the missing files. Commented Aug 11, 2009 at 21:19
  • I think you're on an RPM-based system. (Please post your OS and version.) Try seeing what files were installed by fail2ban: rpm -ql fail2ban Also, give us a long listing of all files in /etc/logrotate.d. Commented Aug 15, 2009 at 0:22

3 Answers 3

Reset to default
0

Ok, it seems that it has nothing to do with logrotate. I think the errors you see are from fail2ban which is looking for these files. Try tu run manually the postscript from fail2ban in /etc/logrotate.d/fail2ban (o something like that) and you will see the errors.

Improve this answer
2
  • I think this is the correct solution. I found invalid references in /etc/fail2ban/jail.conf so I've removed these now. If I no longer get the cron error emails I'll mark this as the accepted answer. Thanks! Commented Aug 14, 2009 at 14:35
  • Yes some filters were turned in fail2ban which referenced these files Commented Aug 16, 2009 at 8:43
2

To expand on HD's comment: You need to look more closely at the logrotate.d directory.

Many packages install logrotate config files in that directly. Any logrotate config file in that directory will be run as part of the cron.daily logrotate job.

Take a look through that directory and see if you can't find the offending files based on their names. If not, a grep statement may be your best bet:

grep myhomepage /etc/logrotate.d/*

Edit or remove the files you find as seems appropriate.

If you're not sure where one of those files came from, the following command (on Debian/Ubuntu) will tell you:

dpkg -S /etc/logrotate.d/FILENAME

On RPM-based systems, the following command should tell you which package installed the file:

rpm -qf /etc/logrotate.d/FILENAME
Improve this answer
3
  • Thanks for the tips, I've tried that command but it has returned nothing. I've updated the bottom of the question above. Commented Aug 12, 2009 at 9:45
  • It's almost certainly one of the files in /etc/logrotate.d. Though why grep isn't finding anything is a mystery to me. You did enter both grep statements as separate commands, right? (You've got them printed on the same line in your edit.) Commented Aug 13, 2009 at 22:46
  • Yes I've tried them as separate commands. I've updated the question to clarify Commented Aug 14, 2009 at 14:00
-1

As the command being called is:

/usr/sbin/logrotate /etc/logrotate.conf

I'd probably look in:

/etc/logrotate.conf
Improve this answer
1
  • Patrick posted logrotate.conf above. The answer wasn't there. Commented Aug 11, 2009 at 23:47

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.