2

Logrotate runs daily and emails me a report. This has been working fine however I now get the following email daily also:

Date: Mon, 10 Aug 2009 04:02:08 +0100
From: root@localhost.localdomain (Cron Daemon)
To: root@localhost.localdomain
Subject: Cron <root@dev> run-parts /etc/cron.daily
Auto-Submitted: auto-generated
X-Cron-Env: <SHELL=/bin/bash>
X-Cron-Env: <PATH=/sbin:/bin:/usr/sbin:/usr/bin>
X-Cron-Env: <MAILTO=root>
X-Cron-Env: <HOME=/>
X-Cron-Env: <LOGNAME=root>
X-Cron-Env: <USER=root>

/etc/cron.daily/logrotate:

ERROR  No file found for /var/log/apache*/*error.log
ERROR  No file found for /home/www/myhomepage/error.log
ERROR  No file found for /var/www/*/logs/access_log

The above log directories do not exist and I don't know why logrotate suddenly decided to include them. I think this problem started after I installed fail2ban.

/etc/cron.daily/logrotate contains:

#!/bin/sh

/usr/sbin/logrotate /etc/logrotate.conf
EXITVALUE=$?
if [ $EXITVALUE != 0 ]; then
    /usr/bin/logger -t logrotate "ALERT exited abnormally with [$EXITVALUE]"
fi
exit 0

/etc/logrotate.conf contains:

# see "man logrotate" for details
# rotate log files weekly
weekly

# keep 4 weeks worth of backlogs
rotate 4

# create new (empty) log files after rotating old ones
create

# uncomment this if you want your log files compressed
#compress

# RPM packages drop log rotation information into this directory
include /etc/logrotate.d

# no packages own wtmp -- we'll rotate them here
/var/log/wtmp {
    monthly
    minsize 1M
    create 0664 root utmp
    rotate 1
}

/etc/logrotate.d/httpd contains:

/var/log/httpd/*log {
    missingok
    notifempty
    sharedscripts
    postrotate
        /sbin/service httpd reload > /dev/null 2>/dev/null || true
    endscript
}

I'm not sure where the reference to /var/log/apache*/error.log, /home/www/myhomepage/error.log or /var/www//logs/access_log is.

Any ideas?

Thanks, Patrick

EDIT Thanks for the responses, here's what I've tried:

vatican:~# grep myhomepage /etc/logrotate.d/*
vatican:~# grep apache /etc/logrotate.d/*
vatican:~# grep www /etc/logrotate.d/*

Nothing returned! This is strange!

EDIT Thanks again for the responses. The problem was after all caused by fail2ban. The references were made in the jail.conf file. I've corrected these references and the issue is resolved.

Patrick Kiernan
  • 23
  • 5
  • Try: grep apache /etc/logrotate.d/* to find any reference to the missing files. – hdanniel Aug 11 '09 at 21:19
  • I think you're on an RPM-based system. (Please post your OS and version.) Try seeing what files were installed by fail2ban: rpm -ql fail2ban Also, give us a long listing of all files in /etc/logrotate.d. – Schof Aug 15 '09 at 00:22

3 Answers3

2

To expand on HD's comment: You need to look more closely at the logrotate.d directory.

Many packages install logrotate config files in that directly. Any logrotate config file in that directory will be run as part of the cron.daily logrotate job.

Take a look through that directory and see if you can't find the offending files based on their names. If not, a grep statement may be your best bet:

grep myhomepage /etc/logrotate.d/*

Edit or remove the files you find as seems appropriate.

If you're not sure where one of those files came from, the following command (on Debian/Ubuntu) will tell you:

dpkg -S /etc/logrotate.d/FILENAME

On RPM-based systems, the following command should tell you which package installed the file:

rpm -qf /etc/logrotate.d/FILENAME
Schof
  • 972
  • 1
  • 6
  • 10
  • Thanks for the tips, I've tried that command but it has returned nothing. I've updated the bottom of the question above. – Patrick Kiernan Aug 12 '09 at 09:45
  • It's almost certainly one of the files in /etc/logrotate.d. Though why grep isn't finding anything is a mystery to me. You did enter both grep statements as separate commands, right? (You've got them printed on the same line in your edit.) – Schof Aug 13 '09 at 22:46
  • Yes I've tried them as separate commands. I've updated the question to clarify – Patrick Kiernan Aug 14 '09 at 14:00
1

Ok, it seems that it has nothing to do with logrotate. I think the errors you see are from fail2ban which is looking for these files. Try tu run manually the postscript from fail2ban in /etc/logrotate.d/fail2ban (o something like that) and you will see the errors.

hdanniel
  • 4,293
  • 23
  • 25
  • I think this is the correct solution. I found invalid references in /etc/fail2ban/jail.conf so I've removed these now. If I no longer get the cron error emails I'll mark this as the accepted answer. Thanks! – Patrick Kiernan Aug 14 '09 at 14:35
  • Yes some filters were turned in fail2ban which referenced these files – Patrick Kiernan Aug 16 '09 at 08:43
-1

As the command being called is:

/usr/sbin/logrotate /etc/logrotate.conf

I'd probably look in:

/etc/logrotate.conf
Joe H.
  • 1,917
  • 12
  • 13