2

This is my conf:

/var/log/apache2/*.log {
        weekly
        missingok
        rotate 52
        compress
        delaycompress
        notifempty
        create 640 root adm
        sharedscripts
        postrotate
                if /etc/init.d/apache2 status > /dev/null ; then \
                    /etc/init.d/apache2 reload > /dev/null; \
                fi;
        endscript
        prerotate
                if [ -d /etc/logrotate.d/httpd-prerotate ]; then \
                        run-parts /etc/logrotate.d/httpd-prerotate; \
                fi; \
        endscript
}

If I undertand correctly, it should hold 52 weeks of worth logs (packed), but they get deleted after every week instead.

I have 2 virtual hosts, one is www and the other one is test subdomain. This is how I tell my sites to be logged from sites-enabled conf.

<VirtualHost *:80>
    ServerAdmin [email protected]
    ServerName test.xxx.com
    ServerAlias test.xxx.com
    DocumentRoot /var/www/test.xxx.com/public_html
    <Directory /var/www/test.xxx.com/public_html/>
        Options Indexes FollowSymLinks
        AllowOverride All
        Require all granted
    </Directory>
    AddDefaultCharset UTF-8
    ErrorLog ${APACHE_LOG_DIR}/test.xxx.com/error.log
    CustomLog ${APACHE_LOG_DIR}/test.xxx.com/access.log combined
</VirtualHost>

Where xxx.com is my domain and test.xxx.com folder does exist in apache log dir. The logging works fine, but the old logs just dissapear!

I did: logrotate -f -d /var/log/apache2/xxx.com/access.log as @Craig Miskell suggested. The output I got was:

    error: /var/log/apache2/xx.com/access.log:1 lines must begin with a keyword or a filename (possibly in double quotes)
    error: /var/log/apache2/xxx.com/access.log:2 lines must begin with a keyword or a filename (possibly in double quotes)
    error: /var/log/apache2/xxx.com/access.log:3 lines must begin with a keyword or a filename (possibly in double quotes)
    error: /var/log/apache2/xxx.com/access.log:4 lines must begin with a keyword or a filename (possibly in double quotes)
etc...

I opened the log file and everything seems fine. I even used some software called Apache Logs Viewer (on Windows), this program also understands why log file very well.

Few first lines of the log file in question:

999.999.999.999 - - [26/Dec/2014:11:28:41 +0000] "GET /contact HTTP/1.1" 200 1622 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 OPR/26.0.1656.60"
999.999.999.999 - - [26/Dec/2014:11:31:01 +0000] "GET /contact HTTP/1.1" 200 1622 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 OPR/26.0.1656.60"
999.999.999.999 - - [26/Dec/2014:11:31:01 +0000] "GET /assets/css/normalize.css HTTP/1.1" 200 3034 "http://www.xxxxxx.com/contact" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 OPR/26.0.1656.60"
999.999.999.999 - - [26/Dec/2014:11:31:01 +0000] "GET /assets/css/skeleton.css HTTP/1.1" 200 4680 "http://www.xxxxxx.com/contact" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 OPR/26.0.1656.60"
999.999.999.999 - - [26/Dec/2014:11:31:01 +0000] "GET /assets/js/main.js HTTP/1.1" 200 1038 "http://www.xxxxxx.com/contact" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 OPR/26.0.1656.60"
999.999.999.999 - - [26/Dec/2014:11:31:01 +0000] "GET /assets/js/moment.js HTTP/1.1" 200 14752 "http://www.xxxxxx.com/contact" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 OPR/26.0.1656.60"
999.999.999.999 - - [26/Dec/2014:11:31:01 +0000] "GET /assets/images/logo-inverted.png HTTP/1.1" 200 1864 "http://www.xxxxxx.com/contact" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 OPR/26.0.1656.60"
999.999.999.999 - - [26/Dec/2014:11:31:01 +0000] "GET /assets/images/logo.png HTTP/1.1" 200 3681 "http://www.xxxxxx.com/contact" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 OPR/26.0.1656.60"

I changed some IP and domains but everything else is as it is...

Googling the problem it looks like the file is not in correct (unix?) format, but I'm not even the one who is writing the file or creating new one, how can I create it wrong?!

3
  • Try running "logrotate -f -d" This will run it in debug mode (noop), and will tell you what it's trying to do. Maybe that will give some insights into what's going on. Dec 30, 2014 at 19:44
  • Dear Craig, I did what you suggested. Please see my edited question.
    – Badr Hari
    Dec 30, 2014 at 19:55
  • 1
    You should use logrotate -f -d config-file and not logrotate -f -d log-file
    – Zimmi
    Dec 30, 2014 at 20:17

1 Answer 1

3

As far as I know, the * wildcard sign expands only to one directory level, not more. So, in your configuration file use :

/var/log/apache2/test.xxx.com/*.log {
    your config here
}

or

/var/log/apache2/*/*.log {
        your config here
}
1
  • Thank you, I think this was the problem. If I do logrotate -config file, I don't get any errors. Hopefully the don't dissapear any more.
    – Badr Hari
    Dec 30, 2014 at 20:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .