3

I have a CentOS 6.7 box that for some reason fails to rotate logs daily. I'm getting an e-mail similar to this one every day in /var/mail/root:

To: [email protected]
Content-Type: text/plain; charset="ANSI_X3.4-1968"
Subject: Anacron job 'cron.daily' on server.nl
Message-Id: <[email protected]>
Date: Wed,  9 Mar 2016 03:42:02 +0100 (CET)

/etc/cron.daily/logrotate:

error: error creating unique temp file: Permission denied

Running logrotate -vf /etc/logrotate.conf rotates logs as expected without errors or warnings. SELinux is enabled so I suspected that it might be the cause of the permission denied error, but /var/log/audit/audit.log doesn't have entries for anything in the last few weeks.

I'm not sure how to troubleshoot what is causing logrotate to fail in the night while it working fine during the day if I'm running it manually.

Addition March 10: thanks to Iain I've been able to get log output of what (ana)cron is doing during the night, at the end of /tmp/logrotate.out are the following lines:

@rotating pattern: /var/log/btmp  monthly (1 rotations)
empty log files are rotated, old logs are removed
considering log /var/log/btmp
  log does not need rotating
set default create context
error: error creating unique temp file: Permission denied

This was not what I was expecting since it is not an error related to the Rails apps' logs I was trying to troubleshoot. By not focusing on the error message itself (which yielded only a couple of hits on Google in Korean and Russian) but more on that actual problem I'm having, I found logrotate cron job not rotating certain logs which is very similar to the problem I'm trying to solve (my nginx logs do rotate, it skips the Rails logs). So it might be SELinux related after all, even if it didn't show up in audit.log. I'm trying the solution posted there.

Improve this question

2 Answers 2

Reset to default
3

The first thing I would do to try and debug this would be to modify the logrotate script that cron runs and have it run logrotate in verbose mode.

My script has this line in /etc/cron.daily/logrotate

 /usr/sbin/logrotate /etc/logrotate.conf

I would change it to

 /usr/sbin/logrotate -v /etc/logrotate.conf >>/tmp/logrotate.out 2>&1
Improve this answer
4
  • Thanks, I've changed that line and cron should run in about 10 hours.
    – Rafe
    Mar 9, 2016 at 16:37
  • I've updated my original question with stuff I gathered from the log.
    – Rafe
    Mar 10, 2016 at 12:12
  • 1
    Your question was how to go about debugging it. I provided that answer, which if correct you should accept. If you have gathered more data based upon the answer above and are unable to resolve this issue yourself you should open a new question. remember, this is a Q&A site not a tech support site. This is not a ticket it's a question, it has been answered sufficiently that you have oved on to another question. We are not your tech support.
    – user9517
    Mar 10, 2016 at 12:20
  • I'm aware this is not tech support and I'm thankful for your help in getting more info. I didn't know appending the original question was considered bad form. I will open a new question in a minute.
    – Rafe
    Mar 10, 2016 at 12:24
2

You should add the -s option to logrotate to specify the path of a (writable) temp file.

Improve this answer
1
  • Thanks for your answer. As it turns out it actually was a SELinux problem and the solution posted in serverfault.com/questions/491703/… fixed it for me. For some reason SELinux violations are not logged on this box I inherited, it is something I've been running into with some other stuff as wel.
    – Rafe
    May 10, 2016 at 9:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .