[SOLVED] zimbra logrotate broke after 6.0.9 update

[liverpoolfcfan]

I have just discovered that my zimbra-stats.log file is almost 1GB.

I searched around the forum, and verified that the cron jobs are still there, and permissions look right, etc.

I grep'ed /var/log/messages for logrotate and found


[root@zimbra etc]# grep logrotate /var/log/messages
Nov 23 04:02:06 zimbra logrotate: ALERT exited abnormally with [1]
Nov 24 04:02:06 zimbra logrotate: ALERT exited abnormally with [1]
...
Dec 14 04:02:06 zimbra logrotate: ALERT exited abnormally with [1]
Dec 15 04:02:05 zimbra logrotate: ALERT exited abnormally with [1]

Nov 22 was the day I upgraded to 6.0.9 !

Can anyone tell me how to get this fixed.

Or, can someone explain how I can manually rotate the individual log files to see what is broken.

Thanks in advance.

[bdial]

do the other logs get rotated fine?

this is all defined in /etc/logrotate.d/zimbra . if you look there you can kind of get an idea of what commands have to be run before/after you rotate a log manually

[liverpoolfcfan]

As far as I can tell nothing in the /var/log folder is rotating now.

Weekly cron.n logs were 7/11, 14/11, 21/11 - then nothing since. Same for messages.n, etc.

I have looked in the zimbra file but wasn't sure how to interpret it exactly. That is why I asked if someone could explain the process. I am quite happy to try it, and report back my findings if I know what to do.

[bdial]

try to run it manually as root with verbose option maybe it will give more error output to find the cause

logrotate -v /etc/logrotate.conf

[liverpoolfcfan]

Error at the zimbra file ...

reading config file zimbra
reading config info for /var/log/zimbra.log
error: zimbra:5 unknown user 'USER'

Here is the start of the zimbra file

/var/log/zimbra.log {
    daily
    missingok
    notifempty
    create 0644 USER GROUP
    postrotate
      killall -HUP syslogd 2> /dev/null || true
      su - zimbra -c "/opt/zimbra/bin/zmswatchctl restart" > /dev/null 2>&1 || true
    endscript
    compress
}

so, I assume it is not happy with USER and GROUP.

What should be there ?

[liverpoolfcfan]

Also, may be relevant, the permissions on the zimbra file in logrotate.d

[root@zimbra logrotate.d]# ls -al zimbra
-r--r--r-- 1 root root 2592 Nov 22 10:25 zimbra

Is it possible a template file got dropped with read-only permissions, and the installer was not able to edit it afterwards to replace the USER and GROUP ?

[bdial]

yeah that should be

create 0644 zimbra zimbra

the permissions on the logrotate file are fine, the install script probably removes the file before putting a new one there, and has permission to do so at the directory level. not sure why it wouldn't have put the right user/group in there but it's easily fixed

[liverpoolfcfan]

Interestingly, it is just the first two entries in the zimbra file that have the problem.

Do I recall reading somewhere that there were changes associated with zipping up some of these logs on rotation ?

Is it possible that the shipped file in 6.0.9 FOSS is not correct ?

/var/log/zimbra.log {
    daily
    missingok
    notifempty
    create 0644 USER GROUP
    postrotate
      killall -HUP syslogd 2> /dev/null || true
      su - zimbra -c "/opt/zimbra/bin/zmswatchctl restart" > /dev/null 2>&1 || true
    endscript
    compress
}

/var/log/zimbra-stats.log {
    daily
    missingok
    notifempty
    create 0644 USER GROUP
    postrotate
      killall -HUP syslogd 2> /dev/null || true
      su - zimbra -c "/opt/zimbra/bin/zmlogswatchctl restart" > /dev/null 2>&1 || true
    endscript
    rotate 0
}

/opt/zimbra/log/myslow.log {
    daily
    missingok
    copytruncate
    rotate 30
    notifempty
    create 0644 zimbra zimbra
    compress
}

/opt/zimbra/log/logger_myslow.log {
    daily
    missingok
    copytruncate
    notifempty
    create 0660 zimbra zimbra
    compress
    size 5000k
    rotate 7
} 

/opt/zimbra/log/clamd.log {
    daily
    missingok
    copytruncate
    notifempty
    create 0660 zimbra zimbra
    postrotate
     kill -HUP `cat /opt/zimbra/log/clamd.pid 2> /dev/null` 2> /dev/null || true
    endscript
    compress
    size 5000k
    rotate 7
}

/opt/zimbra/log/freshclam.log {
    daily
    missingok
    copytruncate
    notifempty
    create 0660 zimbra zimbra
    postrotate
     kill -HUP `cat /opt/zimbra/log/freshclam.pid 2> /dev/null` 2> /dev/null || true
    endscript
    compress
    size 5000k
    rotate 7
}   

/opt/zimbra/log/zmlogswatch.out {
    daily
    missingok
    copytruncate
    notifempty
    create 0740 zimbra zimbra
    postrotate
      su - zimbra -c "/opt/zimbra/bin/zmlogswatchctl restart" > /dev/null 2>&1 || true
    endscript
    rotate 5
    compress
}

/opt/zimbra/log/zmswatch.out {
    daily
    missingok
    copytruncate
    notifempty
    create 0740 zimbra zimbra
    postrotate
      su - zimbra -c "/opt/zimbra/bin/zmswatchctl restart" > /dev/null 2>&1 || true
    endscript
    rotate 5
    compress
}

/opt/zimbra/log/zmmtaconfig.log {
    daily
    missingok
    copytruncate
    notifempty
    create 0740 zimbra zimbra
    postrotate
      su - zimbra -c "/opt/zimbra/bin/zmmtaconfigctl restart" > /dev/null 2>&1 || true
    endscript
    rotate 5
    compress
}

/opt/zimbra/log/nginx.log /opt/zimbra/log/nginx.access.log {
    daily
    sharedscripts
    missingok
    notifempty
    create 0644 zimbra zimbra
    postrotate
      kill -USR1 `cat /opt/zimbra/log/nginx.pid 2> /dev/null` 2> /dev/null || true
    endscript
    rotate 7
    compress
}

/opt/zimbra/zmstat/zmstat.out {
    daily
    missingok
    copytruncate
    rotate 7
    notifempty
    compress
}

[bdial]

the "compress" directive in here is what does that

it's possible the original was broken. you'd have to unpack the release and check to be sure.

[liverpoolfcfan]

I changed the USER and GROUP for the two bad entries.

/var/log/zimbra.log {
    daily
    missingok
    notifempty
    create 0644 zimbra zimbra
    postrotate
      killall -HUP syslogd 2> /dev/null || true
      su - zimbra -c "/opt/zimbra/bin/zmswatchctl restart" > /dev/null 2>&1 || true
    endscript
    compress
}

/var/log/zimbra-stats.log {
    daily
    missingok
    notifempty
    create 0644 zimbra zimbra
    postrotate
      killall -HUP syslogd 2> /dev/null || true
      su - zimbra -c "/opt/zimbra/bin/zmlogswatchctl restart" > /dev/null 2>&1 || true
    endscript
    rotate 0
}

I will leave it to cron to run the process overnight as normal, and will check tomorrow to see if everything has worked as it should.

Thanks for your help.