logrotate exim error logs

Tazmanian79 · Nov 13, 2015

Logrotate is configured to rotate on a montly base.

It is working expect on 2 files
var/log/exim/rejectlog
var/log/exim/mainlog

Both of these files have data in it since 2014-11-03
So from that date rotation stopped, on those 2 files, other file are rotated as expected..

etc/logrotate.d/exim and directadmin had permissions set to 755, but I changed it yesterday to 644.
However, lograte on those 2 files still not working.

Anyone that can help me with this issue?

Richard G · Nov 13, 2015

I presume you are running Centos?
Have both files still "mail" as owner and group?
If not:

Code:

chown mail:mail /var/log/exim -R

Also check /etc/logrotate.d/exim it should look like this:

Code:

/var/log/exim/mainlog /var/log/exim/processlog /var/log/exim/rejectlog /var/log/exim/paniclog {
sharedscripts
}

Tazmanian79 · Nov 13, 2015

Hi Richard,

Yes, I'm running CentOS 6

All files in the /var/log/exim/ directory have "mail" als owner and group.

And the /etc/logrotate.d/exim looks exactly as you describe

I see that all other files where logrotate is working are cleared every 8th of the month. So maybe those 2 files will be cleared on 8 decembre?

zEitEr · Nov 13, 2015

Run logrotate in debug mode with:

Code:

logrotate -d /etc/logrotate.conf 2>&1 | less

Tazmanian79 · Nov 13, 2015

result of the logrotate debug

Code:

[root@srv1 ~]# /usr/sbin/logrotate -d /etc/logrotate.conf 2>&1 | less
reading config file /etc/logrotate.conf
including /etc/logrotate.d
reading config file apache
reading config info for /var/log/httpd/access_log /var/log/httpd/agent_log /var/log/httpd/error_log /var/log/httpd/referer_log /var/log/httpd/suexec_log /var/log/suphp.log
reading config file directadmin
reading config info for /var/log/directadmin/error.log /var/log/directadmin/errortaskq.log /var/log/directadmin/security.log /var/log/directadmin/system.log /var/log/directadmin/login.log
reading config file exim
reading config info for /var/log/exim/mainlog /var/log/exim/processlog /var/log/exim/rejectlog /var/log/exim/paniclog
reading config file lfd
reading config info for /var/log/lfd.log
reading config file mysql
reading config info for /var/lib/mysql/mysqld.log
reading config file named
reading config info for /var/named/data/named.run
reading config file proftpd
reading config info for /var/log/proftpd/access.log /var/log/proftpd/auth.log /var/log/proftpd/xferlog.legacy
reading config file samba
reading config info for /var/log/samba/*
olddir is now /var/log/samba/old
reading config file syslog
reading config info for /var/log/cron
/var/log/maillog
/var/log/messages
/var/log/secure
/var/log/spooler

reading config file yum
reading config info for /var/log/yum.log
reading config info for /var/log/wtmp
reading config info for /var/log/btmp

Handling 12 logs

rotating pattern: /var/log/httpd/access_log /var/log/httpd/agent_log /var/log/httpd/error_log /var/log/httpd/referer_log /var/log/httpd/suexec_log /var/log/suphp.log  weekly (4 rotations)
empty log files are rotated, old logs are removed
considering log /var/log/httpd/access_log
  log does not need rotating
considering log /var/log/httpd/agent_log
  log /var/log/httpd/agent_log does not exist -- skipping
considering log /var/log/httpd/error_log
  log does not need rotating
considering log /var/log/httpd/referer_log
  log /var/log/httpd/referer_log does not exist -- skipping
considering log /var/log/httpd/suexec_log
  log /var/log/httpd/suexec_log does not exist -- skipping
considering log /var/log/suphp.log
  log /var/log/suphp.log does not exist -- skipping
not running postrotate script, since no logs were rotated

rotating pattern: /var/log/directadmin/error.log /var/log/directadmin/errortaskq.log /var/log/directadmin/security.log /var/log/directadmin/system.log /var/log/directadmin/login.log  weekly (4 rotations)
empty log files are rotated, old logs are removed
considering log /var/log/directadmin/error.log
  log does not need rotating
considering log /var/log/directadmin/errortaskq.log
  log does not need rotating
considering log /var/log/directadmin/security.log
  log does not need rotating
considering log /var/log/directadmin/system.log
  log does not need rotating
considering log /var/log/directadmin/login.log
  log does not need rotating
not running postrotate script, since no logs were rotated

rotating pattern: /var/log/exim/mainlog /var/log/exim/processlog /var/log/exim/rejectlog /var/log/exim/paniclog  weekly (4 rotations)
empty log files are rotated, old logs are removed
considering log /var/log/exim/mainlog
  log does not need rotating
considering log /var/log/exim/processlog
error: stat of /var/log/exim/processlog failed: No such file or directory
considering log /var/log/exim/rejectlog
  log does not need rotating
considering log /var/log/exim/paniclog
  log does not need rotating

rotating pattern: /var/log/lfd.log  weekly (1 rotations)
empty log files are rotated, old logs are removed
considering log /var/log/lfd.log
  log does not need rotating

rotating pattern: /var/lib/mysql/mysqld.log  after 1 days (3 rotations)
empty log files are not rotated, old logs are removed
considering log /var/lib/mysql/mysqld.log
  log /var/lib/mysql/mysqld.log does not exist -- skipping
not running postrotate script, since no logs were rotated

rotating pattern: /var/named/data/named.run  weekly (4 rotations)
empty log files are rotated, old logs are removed
considering log /var/named/data/named.run
  log does not need rotating
not running postrotate script, since no logs were rotated

rotating pattern: /var/log/proftpd/access.log /var/log/proftpd/auth.log /var/log/proftpd/xferlog.legacy  weekly (4 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/proftpd/access.log
  log does not need rotating
considering log /var/log/proftpd/auth.log
  log does not need rotating
considering log /var/log/proftpd/xferlog.legacy
  log does not need rotating
not running postrotate script, since no logs were rotated
not running postrotate script, since no logs were rotated
not running postrotate script, since no logs were rotated

rotating pattern: /var/log/samba/*  weekly (4 rotations)
olddir is /var/log/samba/old, empty log files are not rotated, old logs are removed

rotating pattern: /var/log/cron
/var/log/maillog
/var/log/messages
/var/log/secure
/var/log/spooler
 weekly (4 rotations)
empty log files are rotated, old logs are removed
considering log /var/log/cron
  log does not need rotating
considering log /var/log/maillog
  log does not need rotating
considering log /var/log/messages
  log does not need rotating
considering log /var/log/secure
  log does not need rotating
considering log /var/log/spooler
  log does not need rotating
not running postrotate script, since no logs were rotated


rotating pattern: /var/log/yum.log  yearly (4 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/yum.log
  log does not need rotating

rotating pattern: /var/log/wtmp  monthly (1 rotations)
empty log files are rotated, only log files >= 1048576 bytes are rotated, old logs are removed
considering log /var/log/wtmp
  log does not need rotating

rotating pattern: /var/log/btmp  monthly (1 rotations)
empty log files are rotated, old logs are removed
considering log /var/log/btmp
  log does not need rotating

Tazmanian79 · Nov 15, 2015

Tonight the logrotate run and all files had to be rotated. It's on a weekly basis, not monthly like I wrote earlier.

All filles were rotated, except those in the /var/log/exim/ directory (mainlog/rejectlog/paniclog)

Anyone that can help me to solve this?

Richard G · Nov 15, 2015

Just how big are those files? Because log says:

considering log /var/log/exim/mainlog
log does not need rotating

same goes for the other 2 logfiles. Seems logrotate has determined no rotation is necessary.

Have you checked /var/lib/logrotate.status to see when they are rotated for the last?

Tazmanian79 · Nov 16, 2015

Richard G said:
Just how big are those files? Because log says:
same goes for the other 2 logfiles. Seems logrotate has determined no rotation is necessary.

They are 27 and 20 Mb, ok not really big, but all other files or much smaller and they are rotated every week.

Have you checked /var/lib/logrotate.status to see when they are rotated for the last?

This is the logrotate.status file:

Code:

logrotate state -- version 2
"/var/log/proftpd/access.log" 2015-11-11
"/var/log/yum.log" 2015-1-31
"/var/log/exim/rejectlog" 2015-11-15
"/var/named/data/named.run" 2015-11-15
"/var/log/directadmin/error.log" 2015-11-15
"/var/log/directadmin/errortaskq.log" 2015-11-15
"/var/log/exim/mainlog" 2015-11-15
"/var/log/exim/processlog" 2012-4-29
"/var/log/lfd.log" 2015-11-15
"/var/log/directadmin/security.log" 2015-11-15
"/var/lib/mysql/mysqld.log" 2012-3-14
"/var/log/httpd/suexec_log" 2012-3-14
"/var/log/httpd/error_log" 2015-11-15
"/var/log/suphp.log" 2012-4-29
"/var/log/wtmp" 2012-3-14
"/var/log/httpd/agent_log" 2012-3-14
"/var/log/exim/paniclog" 2015-11-15
"/var/log/proftpd/xferlog.legacy" 2015-11-11
"/var/log/spooler" 2015-11-15
"/var/log/btmp" 2015-11-1
"/var/log/directadmin/login.log" 2015-11-15
"/var/log/proftpd/auth.log" 2015-11-15
"/var/log/maillog" 2015-11-15
"/var/log/directadmin/system.log" 2015-11-15
"/var/log/httpd/referer_log" 2012-3-14
"/var/log/secure" 2015-11-15
"/var/log/messages" 2015-11-15
"/var/log/httpd/access_log" 2015-11-15
"/var/log/cron" 2015-11-15

zEitEr · Nov 16, 2015

@Richard,

From man pages:

Code:

       -d, --debug
              Turns on debug mode and implies -v.  In debug mode, no changes will be made to the logs or to the logrotate state file.

So no logs will be rotated in a debug mode.

@Tazmanian79,

According to the logrotate.status file exim's logs were rotated.

All filles were rotated, except those in the /var/log/exim/ directory (mainlog/rejectlog/paniclog)

Why do you think they were not rotated?

Tazmanian79 · Nov 16, 2015

zEitEr said:
Why do you think they were not rotated?

Because I see in Directadmins Logviewer that the mainlog file remains 27 Mb, and first entry in that file is from 03/11/2014. That was last date server was restarted.

And the directory /var/log/exim/ looks like this

Code:

-rw-r--r-- 1 mail mail 28486709 Nov 16 11:33 mainlog
-rw-r--r-- 1 mail mail     2114 Apr 27  2012 mainlog-20120428
-rw-r--r-- 1 mail mail      624 Apr 29  2012 mainlog-20120429
-rw-r--r-- 1 mail mail     1144 Nov 13 01:06 paniclog
-rw-r--r-- 1 mail mail        0 Mar 13  2012 paniclog-20120428
-rw-r--r-- 1 mail mail        0 Apr 28  2012 paniclog-20120429
-rw-r--r-- 1 mail mail        0 Mar 13  2012 processlog-20120428
-rw-r--r-- 1 mail mail        0 Apr 28  2012 processlog-20120429
-rw-r--r-- 1 mail mail 20787826 Nov 16 10:56 rejectlog
-rw-r--r-- 1 mail mail        0 Mar 13  2012 rejectlog-20120428
-rw-r--r-- 1 mail mail      624 Apr 29  2012 rejectlog-20120429

zEitEr · Nov 16, 2015

Try to run in force mode:

Code:

       -f, --force 
             Tells  logrotate to force the rotation, even if it doesn’t think this is necessary.  Sometimes this is useful 
             after adding new entries to a logrotate config file, or if old log files have been removed by hand, as the 
             new files will be created, and logging will continue  correctly.

with this command:

Code:

logrotate -f /etc/logrotate.conf

and see whether or not it will rotate exim logs. All other logs will be rotated as well.

Tazmanian79 · Nov 16, 2015

I tried this

Code:

/usr/sbin/logrotate -f /etc/logrotate.conf 2>&1 | less

But I have error

Code:

error: stat of /var/log/exim/processlog failed: No such file or directory

zEitEr · Nov 16, 2015

Because of the error exim logs are not rotated.

Update /etc/logrotate.d/exim to the following view:

Code:

/var/log/exim/mainlog /var/log/exim/processlog /var/log/exim/rejectlog /var/log/exim/paniclog {
sharedscripts
missingok
}

and then try again.

Logrotate should go fine, then you could try and find reasons of why you are missing /var/log/exim/processlog.

Try to restart exim and see whether or not it creates /var/log/exim/processlog.

Tazmanian79 · Nov 16, 2015

Updated the script and run it again (forced)
Now everything is rotated, thanks!!

I also restarted exim but processlog was not created. Is this file necessary for something? Should I create it manually?

zEitEr · Nov 16, 2015

I'm not quite sure where it comes from neither exim.conf nor /etc/init.d/exim has any references to processlog. Probably it's coming from old times... on my server it's empty. Probably John could clarify it.

Nothing useful found here:
http://www.directadmin.com/search_versions.php?query=processlog
http://help.directadmin.com/?query=processlog

Richard G · Nov 16, 2015

I do have processlog on the servers and it's rotated, but they are always 0 kb.

You can find in Exim docs what processlog is for. It's used for querying Exim processes.

The shell script called `exiwhat' first of all empties the process log file in Exim's log directory. It then uses the `ps' command to find all processes running exim, and sends each one the SIGUSR1 signal. This causes each process to write a single line describing its current activity to the process log. The script then waits for one second to allow the Exim processes to react, then copies the file to the standard output.

http://www.exim.org/exim-html-2.00/doc/html/spec_47.html

If not present you can also create it:

Code:

touch /var/log/exim/processlog
chown mail:mail /var/log/exim/processlog

Tazmanian79 · Nov 16, 2015

Thanks for all the help

logrotate exim error logs

Tazmanian79

Verified User

Richard G

Verified User

Tazmanian79

Verified User

zEitEr

Super Moderator

Tazmanian79

Verified User

Tazmanian79

Verified User

Richard G

Verified User

Tazmanian79

Verified User

zEitEr

Super Moderator

Tazmanian79

Verified User

zEitEr

Super Moderator

Tazmanian79

Verified User

zEitEr

Super Moderator

Tazmanian79

Verified User

zEitEr

Super Moderator

Richard G

Verified User

Tazmanian79

Verified User