1

I have monitored some strange behavior. Every week at logrotate process time, the apache2 daemon script /etc/init.d/apache2 is being rotated as if it was a log file.

The first week it created another file apache2.1 and emptied apache2. The following week it made apache2.2 and apache2.1 and emptied apache2. And so on.

-rwxr-xr-x 1 root root 6461 2015-04-26 06:25 apache2.4
-rwxr-xr-x 1 root root 6461 2015-05-03 06:25 apache2.3
-rwxr-xr-x 1 root root 6461 2015-05-10 06:25 apache2.2
-rwxr-xr-x 1 root root 6461 2015-05-17 06:25 apache2.1
-rwxr-xr-x 1 root root    0 2015-05-24 06:25 apache2

I am not sure if it is an apache update bug or some scheduled job. Here is my log rotation file:

/var/log/apache2/*.log {
        weekly
        missingok
        rotate 52
        compress
        delaycompress
        notifempty
        create 644 root adm
        sharedscripts
        postrotate
                if [ -f "`. /etc/apache2/envvars ; echo ${APACHE_PID_FILE:-/var/run/apache2.pid}`" ]; then
                        /etc/init.d/apache2 reload > /dev/null
                fi
        endscript
}

My apache2 version: 2.2.12

Edit: logrotate.conf

# see "man logrotate" for details
# rotate log files weekly
weekly

# keep 4 weeks worth of backlogs
rotate 4

# create new (empty) log files after rotating old ones
create

# packages drop log rotation information into this directory
include /etc/logrotate.d

# no packages own wtmp, or btmp -- we'll rotate them here
/var/log/wtmp {
    missingok
    monthly
    create 0664 root utmp
    rotate 1
}

/var/log/btmp {
    missingok
    monthly
    create 0660 root utmp
    rotate 1
}
6
  • Check all your logrotate configfiles, e.g. with "grep /etc/init.d/apache /etc/logrotate.d/*" to see if there are other entries that are doing this. Jun 9, 2015 at 9:37
  • 1
    I didn't find any logrotate configuration file containing the "apache2" under /etc/logrotate.d except that one for apache "/etc/logrotate.d/apache2" which i shared its contents in my question :( Jun 9, 2015 at 10:13
  • The fact the there's an entry for this file in logrotate's status file means logrotate is the one that's doing this. Have you checked /etc/logrotate.conf? Jun 10, 2015 at 7:06
  • The other possibility I see is that something odd is happening with the expansion of the envvars in the Apache logrotate script. Perhaps worth running the code inside the double quotes in the if statement to see what you get. Jun 10, 2015 at 7:11
  • I checked logrotate.conf didn't notice anything unsual, i edit the post with the conf content. do you mean to run this one? . /etc/apache2/envvars ; echo ${APACHE_PID_FILE:-/var/run/apache2.pid} ? Jun 10, 2015 at 8:18

2 Answers 2

0

You can check what logrotate do in /var/lib/logrotate.status file. Also check under /etc/cron.d/ directory if any job exist regarding rotate, or check /var/log/cron log. You might find useful to search the /etc directory for files containing apache2 daemon script:

    find /etc/ -type f -exec grep -H '/etc/init.d/apache2' {} \;
4
  • inside /var/lib/logrotate/status i found record concerning the apache2 daemon file, "/etc/init.d/apache2" 2015-6-7 , i also tried the find statement, but the output was all about "/etc/logrotate.d/apache2" and " /etc/init.d/apache2" no more files, is there any way to check which process or script created/emptied the daemon file? Jun 9, 2015 at 13:36
  • I also find something, i am not sure if it is causing the problem or why?, there was another backup file under /etc/logrotate for apache, so under that path i have 2 files "apache2" and "apache2.bakup" with same content, could it cause that issue? Jun 9, 2015 at 13:41
  • Is adm user exists? Check rudder-project.org/redmine/issues/2379
    – user245263
    Jun 9, 2015 at 14:56
  • I moved the backup file now, rudder doesn't exist, inside the apache2 file, i didn't notice any code for self rotating Jun 9, 2015 at 15:33
0

I found a backup file in same path "/etc/logrotate.d/apache2_backup", which had the same content as "/etc/logrotate.d/apache2", after I moved it to another location and kept only the original, my issue was fixed.

Still i couldn't understand why 2 files with same content causes apache daemon file to log rotate!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .