Logrotate ERROR: No file found for /var/log/apache*/*error.log

Question

Logrotate runs daily and emails me a report. This has been working fine however I now get the following email daily also:

Date: Mon, 10 Aug 2009 04:02:08 +0100
From: [email protected] (Cron Daemon)
To: [email protected]
Subject: Cron <root@dev> run-parts /etc/cron.daily
Auto-Submitted: auto-generated
X-Cron-Env: <SHELL=/bin/bash>
X-Cron-Env: <PATH=/sbin:/bin:/usr/sbin:/usr/bin>
X-Cron-Env: <MAILTO=root>
X-Cron-Env: <HOME=/>
X-Cron-Env: <LOGNAME=root>
X-Cron-Env: <USER=root>

/etc/cron.daily/logrotate:

ERROR  No file found for /var/log/apache*/*error.log
ERROR  No file found for /home/www/myhomepage/error.log
ERROR  No file found for /var/www/*/logs/access_log

The above log directories do not exist and I don't know why logrotate suddenly decided to include them. I think this problem started after I installed fail2ban.

/etc/cron.daily/logrotate contains:

#!/bin/sh

/usr/sbin/logrotate /etc/logrotate.conf
EXITVALUE=$?
if [ $EXITVALUE != 0 ]; then
    /usr/bin/logger -t logrotate "ALERT exited abnormally with [$EXITVALUE]"
fi
exit 0

/etc/logrotate.conf contains:

# see "man logrotate" for details
# rotate log files weekly
weekly

# keep 4 weeks worth of backlogs
rotate 4

# create new (empty) log files after rotating old ones
create

# uncomment this if you want your log files compressed
#compress

# RPM packages drop log rotation information into this directory
include /etc/logrotate.d

# no packages own wtmp -- we'll rotate them here
/var/log/wtmp {
    monthly
    minsize 1M
    create 0664 root utmp
    rotate 1
}

/etc/logrotate.d/httpd contains:

/var/log/httpd/*log {
    missingok
    notifempty
    sharedscripts
    postrotate
        /sbin/service httpd reload > /dev/null 2>/dev/null || true
    endscript
}

I'm not sure where the reference to /var/log/apache*/error.log, /home/www/myhomepage/error.log or /var/www//logs/access_log is.

Any ideas?

Thanks, Patrick

EDIT Thanks for the responses, here's what I've tried:

vatican:~# grep myhomepage /etc/logrotate.d/*
vatican:~# grep apache /etc/logrotate.d/*
vatican:~# grep www /etc/logrotate.d/*

Nothing returned! This is strange!

EDIT Thanks again for the responses. The problem was after all caused by fail2ban. The references were made in the jail.conf file. I've corrected these references and the issue is resolved.

Answer 1

Ok, it seems that it has nothing to do with logrotate. I think the errors you see are from fail2ban which is looking for these files. Try tu run manually the postscript from fail2ban in /etc/logrotate.d/fail2ban (o something like that) and you will see the errors.

Answer 2

To expand on HD's comment: You need to look more closely at the logrotate.d directory.

Many packages install logrotate config files in that directly. Any logrotate config file in that directory will be run as part of the cron.daily logrotate job.

Take a look through that directory and see if you can't find the offending files based on their names. If not, a grep statement may be your best bet:

grep myhomepage /etc/logrotate.d/*

Edit or remove the files you find as seems appropriate.

If you're not sure where one of those files came from, the following command (on Debian/Ubuntu) will tell you:

dpkg -S /etc/logrotate.d/FILENAME

On RPM-based systems, the following command should tell you which package installed the file:

rpm -qf /etc/logrotate.d/FILENAME

Answer 3

As the command being called is:

/usr/sbin/logrotate /etc/logrotate.conf

I'd probably look in:

/etc/logrotate.conf