logrotate does not rotate logs (rsyslog)

[Uwe Lück]

(Expected: auth.log, kern.log, syslog rotated "daily"/"weakly" according to /etd/..., actually: no rotation even after weeks; and manual forcing may fail.)

Being concerned about the amount of GBs that a Lubuntu persistent installation on a USB flash drive may write per day, I observed that auth.log, kern.log, and syslog grow to many MB. They may get about 1000 entries a day, resulting in many GB load for the USB drive per day. I learnt about logrotate and rsyslog and modified /etc/logrotate.conf and /etc/logrotate.d/rsyslog. Yet none had any effect.

I have kept USB installations of Lubuntu 14.04.1 in parallel and saved them after some days, so I could report about a number of experiments. E.g., I started 2014-08-31, and I have a snapshot from 2014-09-22 where I had not changed /etc/logrotate.conf, neither /etc/logrotate.d/rsyslog ("daily", "weekly"), and the three files still have the entries from 2014-08-31, although three "weeks" had passed.

#51879 (2006) and #1278193 (Feb 2014) are very similar, however:
* I observed growing kern.log and syslog to more than 100MB (to "out of memory" finally) in some installations in summer 2013; in later installations the same year and before 14.04, the problem vanished (I watched the sizes manually/regularly – difference to #51879: after 2006, problem recurred, vanished, recurred).
* With Lubuntu 14.04.1 recently, I changed "weekly" into "daily" in /etc/logratate.conf and in /etc/logrotate.d/rsyslog, but three days later auth.log, kern.log, and syslog still had no older copies and still contained messages from the last three days. Then I did sudo logrotate-f /etc/logrotate.conf, which works, but still after another three days those three logs had not been rotated.

Actually I also have tried sudo logrotate -f /etc/logrotate.d/rsyslog, and the result has been exactly as #1258202 (2013). As opposed to the latter report and that for #1278193, I am unable to guess from which changes the problems might have resulted.

ProblemType: Bug
DistroRelease: Ubuntu 14.04
Package: logrotate 3.8.7-1ubuntu1
ProcVersionSignature: Ubuntu 3.13.0-32.57-generic 3.13.11.4
Uname: Linux 3.13.0-32-generic i686
ApportVersion: 2.14.1-0ubuntu3.2
Architecture: i386
CasperVersion: 1.340
CurrentDesktop: LXDE
Date: Sat Oct 25 01:02:40 2014
LiveMediaBuild: Lubuntu 14.04.1 LTS "Trusty Tahr" - Release i386 (20140722.2)
SourcePackage: logrotate
UpgradeStatus: No upgrade log present (probably fresh install)

[Uwe Lück (uwe-lueck)]

"weekly" indeed supported extremely "weakly"

[Uwe Lück (uwe-lueck)]

cf. #1258202 and #1278193 about owning group, here:
$ ls -ld /var/log
drwxrwxr-x 1 root fuse 4096 Okt 25 02:16 /var/log

[Uwe Lück (uwe-lueck)]

auth.log, kern.log, syslog and their old versions by find / -user/group are the only files on my system with owning user syslog and owning group adm. This is what the report is about. Other logs have been rotated.

[Daniel Holbach (dholbach)]

Could this be a duplicate of bug 1385464?

[Uwe Lück (uwe-lueck)]

@#5: no, bug #13854564 produces an error on `# logrotate /etc/logrotate.conf`, while the same command works properly as expected here.

I have now seen (guessed) that /etc/cron.daily/logrotate is not run (status file's mtime is from running logrotate manually), /etc/cron.daily/apport is not run (should remove old crash reports, but I still have all of them), and /etc/cron.daily/dpkg is not run (/var/backups/ is empty); and finally, by grepping from syslogs, that anacron has been "considered" (lines from /etc/cron.*/0anachron), but never actually been run. So the present problem has little to do with logrotate, it's only a symptom of an anacron problem. I see in forums that this sometimes happens in a variety of rather individual, weird situations, I think I now must track the anachron problem on my own, and the present report no longer should be considered, sorry.

[Uwe Lück (uwe-lueck)]

my (rsyslog) logs *are* rotatated now. I found that /usr/sbin/anacron is a symbolic link to /bin/true as in bug #1254614 and renamed /usr/sbin/anacron.distrib found with bug #1254614 into /usr/sbin/anacron. As opposed to there, this has not been undone so far. I find the symlink in some saved persistence files/partitions, even (somewaht opposed to bug #bug #1254614) with Xubuntu 12.10. There is no anacron symlink in the live iso, but it's there even after a live boot without persistence.

[Uwe Lück (uwe-lueck)]

Now I have guessed (at bug 1254614) that the developers have disabled rotating and cron jobs for live sessions *intentionally*. (And I am sorry and annoyed about all my typos above, still wondering how I could avoid them without a preview function here.)

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Mikkel Kirkgaard Nielsen (mikini)]

I assume the affected system is a live USB/installer system? It is not quite obvious from the description.

I am having the same issue of missing logrotation when using the Ubuntu Desktop 14.04.3 LTS installer (http://releases.ubuntu.com/14.04.3/ubuntu-14.04.3-desktop-amd64.iso) as basis for a demonstration/test setup.

Seeing my logs accumulating I tried to configure logrotate but was puzzled when seeing it already configured and cron seems to run cron.daily according to log (.1 is caused by me running logrotate manually):

ubuntu@ubuntu:~$ grep cron.daily /var/log/syslog*
...
/var/log/syslog.1:Jan 11 06:25:01 ubuntu CRON[19057]: (root) CMD (test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily ))
/var/log/syslog.1:Jan 12 06:25:01 ubuntu CRON[20265]: (root) CMD (test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily ))
/var/log/syslog.1:Jan 13 06:25:01 ubuntu CRON[21361]: (root) CMD (test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily ))

Digged a lot to find out /usr/sbin/anacron was intentionally diverted using dpkg-divert, but haven't found out yet if and how this affects the cron.daily execution;

ubuntu@ubuntu:~$ dpkg-divert --list|grep anacron
local diversion of /usr/sbin/anacron to /usr/sbin/anacron.distrib

ubuntu@ubuntu:~$ ls -l /usr/sbin/anacron
lrwxrwxrwx 1 root root 9 Nov 18 14:11 /usr/sbin/anacron -> /bin/true