2

This is my conf:

/var/log/apache2/*.log {
        weekly
        missingok
        rotate 52
        compress
        delaycompress
        notifempty
        create 640 root adm
        sharedscripts
        postrotate
                if /etc/init.d/apache2 status > /dev/null ; then \
                    /etc/init.d/apache2 reload > /dev/null; \
                fi;
        endscript
        prerotate
                if [ -d /etc/logrotate.d/httpd-prerotate ]; then \
                        run-parts /etc/logrotate.d/httpd-prerotate; \
                fi; \
        endscript
}

If I undertand correctly, it should hold 52 weeks of worth logs (packed), but they get deleted after every week instead.

I have 2 virtual hosts, one is www and the other one is test subdomain. This is how I tell my sites to be logged from sites-enabled conf.

<VirtualHost *:80>
    ServerAdmin admin@xxx.com
    ServerName test.xxx.com
    ServerAlias test.xxx.com
    DocumentRoot /var/www/test.xxx.com/public_html
    <Directory /var/www/test.xxx.com/public_html/>
        Options Indexes FollowSymLinks
        AllowOverride All
        Require all granted
    </Directory>
    AddDefaultCharset UTF-8
    ErrorLog ${APACHE_LOG_DIR}/test.xxx.com/error.log
    CustomLog ${APACHE_LOG_DIR}/test.xxx.com/access.log combined
</VirtualHost>

Where xxx.com is my domain and test.xxx.com folder does exist in apache log dir. The logging works fine, but the old logs just dissapear!

I did: logrotate -f -d /var/log/apache2/xxx.com/access.log as @Craig Miskell suggested. The output I got was:

    error: /var/log/apache2/xx.com/access.log:1 lines must begin with a keyword or a filename (possibly in double quotes)
    error: /var/log/apache2/xxx.com/access.log:2 lines must begin with a keyword or a filename (possibly in double quotes)
    error: /var/log/apache2/xxx.com/access.log:3 lines must begin with a keyword or a filename (possibly in double quotes)
    error: /var/log/apache2/xxx.com/access.log:4 lines must begin with a keyword or a filename (possibly in double quotes)
etc...

I opened the log file and everything seems fine. I even used some software called Apache Logs Viewer (on Windows), this program also understands why log file very well.

Few first lines of the log file in question:

999.999.999.999 - - [26/Dec/2014:11:28:41 +0000] "GET /contact HTTP/1.1" 200 1622 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 OPR/26.0.1656.60"
999.999.999.999 - - [26/Dec/2014:11:31:01 +0000] "GET /contact HTTP/1.1" 200 1622 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 OPR/26.0.1656.60"
999.999.999.999 - - [26/Dec/2014:11:31:01 +0000] "GET /assets/css/normalize.css HTTP/1.1" 200 3034 "http://www.xxxxxx.com/contact" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 OPR/26.0.1656.60"
999.999.999.999 - - [26/Dec/2014:11:31:01 +0000] "GET /assets/css/skeleton.css HTTP/1.1" 200 4680 "http://www.xxxxxx.com/contact" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 OPR/26.0.1656.60"
999.999.999.999 - - [26/Dec/2014:11:31:01 +0000] "GET /assets/js/main.js HTTP/1.1" 200 1038 "http://www.xxxxxx.com/contact" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 OPR/26.0.1656.60"
999.999.999.999 - - [26/Dec/2014:11:31:01 +0000] "GET /assets/js/moment.js HTTP/1.1" 200 14752 "http://www.xxxxxx.com/contact" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 OPR/26.0.1656.60"
999.999.999.999 - - [26/Dec/2014:11:31:01 +0000] "GET /assets/images/logo-inverted.png HTTP/1.1" 200 1864 "http://www.xxxxxx.com/contact" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 OPR/26.0.1656.60"
999.999.999.999 - - [26/Dec/2014:11:31:01 +0000] "GET /assets/images/logo.png HTTP/1.1" 200 3681 "http://www.xxxxxx.com/contact" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36 OPR/26.0.1656.60"

I changed some IP and domains but everything else is as it is...

Googling the problem it looks like the file is not in correct (unix?) format, but I'm not even the one who is writing the file or creating new one, how can I create it wrong?!

3
  • Try running "logrotate -f -d" This will run it in debug mode (noop), and will tell you what it's trying to do. Maybe that will give some insights into what's going on. – Craig Miskell Dec 30 '14 at 19:44
  • Dear Craig, I did what you suggested. Please see my edited question. – Badr Hari Dec 30 '14 at 19:55
  • 1
    You should use logrotate -f -d config-file and not logrotate -f -d log-file – Zimmi Dec 30 '14 at 20:17
3

As far as I know, the * wildcard sign expands only to one directory level, not more. So, in your configuration file use :

/var/log/apache2/test.xxx.com/*.log {
    your config here
}

or

/var/log/apache2/*/*.log {
        your config here
}
1
  • Thank you, I think this was the problem. If I do logrotate -config file, I don't get any errors. Hopefully the don't dissapear any more. – Badr Hari Dec 30 '14 at 20:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.