Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Our development team went to start HTTPD and got this:

Starting httpd: (20)Not a directory: httpd: could not open error log file /etc/httpd/logs/error_log.
Unable to open logs

Upon investigation we noticed that the logs symlink within /etc/httpd was a file, OK, so resymlinked. Then noticed that the symlink wasn't the right colour: Wrong Colours

So, went to investigate the /var/log/ folder and found something strange... All of the logs are 0 bytes, all changed at the same time yesterday evening, and all of the log folders that should be folders are now 0 byte files too. See below screenshot for comparison with another (almost identical) server: Comparison

Any ideas on what would cause this? It's a virtual machine, and no others have been affected in an even remotely similar way, so I'm not sure that the hardware (which is also new) is failing at this stage.

share|improve this question
Did logrotate go nuts? – Tom O'Connor Jan 17 '14 at 11:25
Looks like a buggy script that has messed the whole thing up ! – krisFR Jan 17 '14 at 11:28
logrotate is running at 04:02, and there are no scripts that are set to run. Even if there were, what would be used to convert a file to a directory other than deleting the dir and touching the file? – Rudi Visser Jan 17 '14 at 11:33
Typically log files that have been removed are either an operator error or a strong indication that a system is compromised. – HBruijn Jan 17 '14 at 12:03
You may want to consider running a fsck. File system corruption can often make files look like directories or symlinks and other oddities. Be sure to backup or take a snapshot of the VM first. – jeffatrackaid Jan 17 '14 at 19:11

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.