Logrotate runs daily and emails me a report. This has been working fine however I now get the following email daily also:

Date: Mon, 10 Aug 2009 04:02:08 +0100
From: root@localhost.localdomain (Cron Daemon)
To: root@localhost.localdomain
Subject: Cron <root@dev> run-parts /etc/cron.daily
Auto-Submitted: auto-generated
X-Cron-Env: <SHELL=/bin/bash>
X-Cron-Env: <PATH=/sbin:/bin:/usr/sbin:/usr/bin>
X-Cron-Env: <MAILTO=root>
X-Cron-Env: <HOME=/>
X-Cron-Env: <LOGNAME=root>
X-Cron-Env: <USER=root>


ERROR  No file found for /var/log/apache*/*error.log
ERROR  No file found for /home/www/myhomepage/error.log
ERROR  No file found for /var/www/*/logs/access_log

The above log directories do not exist and I don't know why logrotate suddenly decided to include them. I think this problem started after I installed fail2ban.

/etc/cron.daily/logrotate contains:


/usr/sbin/logrotate /etc/logrotate.conf
if [ $EXITVALUE != 0 ]; then
    /usr/bin/logger -t logrotate "ALERT exited abnormally with [$EXITVALUE]"
exit 0

/etc/logrotate.conf contains:

# see "man logrotate" for details
# rotate log files weekly

# keep 4 weeks worth of backlogs
rotate 4

# create new (empty) log files after rotating old ones

# uncomment this if you want your log files compressed

# RPM packages drop log rotation information into this directory
include /etc/logrotate.d

# no packages own wtmp -- we'll rotate them here
/var/log/wtmp {
    minsize 1M
    create 0664 root utmp
    rotate 1

/etc/logrotate.d/httpd contains:

/var/log/httpd/*log {
        /sbin/service httpd reload > /dev/null 2>/dev/null || true

I'm not sure where the reference to /var/log/apache*/error.log, /home/www/myhomepage/error.log or /var/www//logs/access_log is.

Any ideas?

Thanks, Patrick

EDIT Thanks for the responses, here's what I've tried:

vatican:~# grep myhomepage /etc/logrotate.d/*
vatican:~# grep apache /etc/logrotate.d/*
vatican:~# grep www /etc/logrotate.d/*

Nothing returned! This is strange!

EDIT Thanks again for the responses. The problem was after all caused by fail2ban. The references were made in the jail.conf file. I've corrected these references and the issue is resolved.

  • Try: grep apache /etc/logrotate.d/* to find any reference to the missing files.
    – hdanniel
    Aug 11 '09 at 21:19
  • I think you're on an RPM-based system. (Please post your OS and version.) Try seeing what files were installed by fail2ban: rpm -ql fail2ban Also, give us a long listing of all files in /etc/logrotate.d.
    – Schof
    Aug 15 '09 at 0:22

Ok, it seems that it has nothing to do with logrotate. I think the errors you see are from fail2ban which is looking for these files. Try tu run manually the postscript from fail2ban in /etc/logrotate.d/fail2ban (o something like that) and you will see the errors.

  • I think this is the correct solution. I found invalid references in /etc/fail2ban/jail.conf so I've removed these now. If I no longer get the cron error emails I'll mark this as the accepted answer. Thanks! Aug 14 '09 at 14:35
  • Yes some filters were turned in fail2ban which referenced these files Aug 16 '09 at 8:43

To expand on HD's comment: You need to look more closely at the logrotate.d directory.

Many packages install logrotate config files in that directly. Any logrotate config file in that directory will be run as part of the cron.daily logrotate job.

Take a look through that directory and see if you can't find the offending files based on their names. If not, a grep statement may be your best bet:

grep myhomepage /etc/logrotate.d/*

Edit or remove the files you find as seems appropriate.

If you're not sure where one of those files came from, the following command (on Debian/Ubuntu) will tell you:

dpkg -S /etc/logrotate.d/FILENAME

On RPM-based systems, the following command should tell you which package installed the file:

rpm -qf /etc/logrotate.d/FILENAME
  • Thanks for the tips, I've tried that command but it has returned nothing. I've updated the bottom of the question above. Aug 12 '09 at 9:45
  • It's almost certainly one of the files in /etc/logrotate.d. Though why grep isn't finding anything is a mystery to me. You did enter both grep statements as separate commands, right? (You've got them printed on the same line in your edit.)
    – Schof
    Aug 13 '09 at 22:46
  • Yes I've tried them as separate commands. I've updated the question to clarify Aug 14 '09 at 14:00

As the command being called is:

/usr/sbin/logrotate /etc/logrotate.conf

I'd probably look in:

  • Patrick posted logrotate.conf above. The answer wasn't there.
    – Schof
    Aug 11 '09 at 23:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.