Squid3 logrotate error in Ubuntu 12.04

Question

In a Ubuntu 12.04 server, logrotate for Squid3 is not working. I have found the problem while noticing the partition is getting full from squid3 logs. A forced logrotate yields the following error:

~# logrotate -f /etc/logrotate.d/squid3
error: error running shared prerotate script for '/var/log/squid3/*.log

Here is the complete debug output:

~# logrotate -f /etc/logrotate.d/squid3 -d
reading config file /etc/logrotate.d/squid3
reading config info for /var/log/squid3/*.log

Handling 1 logs

rotating pattern: /var/log/squid3/*.log  forced from command line (2 rotations)
empty log files are rotated, old logs are removed
considering log /var/log/squid3/access.log
  log needs rotating
considering log /var/log/squid3/cache.log
  log needs rotating
rotating log /var/log/squid3/access.log, log->rotateCount is 2
dateext suffix '-20140312'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
previous log /var/log/squid3/access.log.1 does not exist
renaming /var/log/squid3/access.log.2.gz to /var/log/squid3/access.log.3.gz (rotatecount 2, logstart 1, i 2),
renaming /var/log/squid3/access.log.1.gz to /var/log/squid3/access.log.2.gz (rotatecount 2, logstart 1, i 1),
renaming /var/log/squid3/access.log.0.gz to /var/log/squid3/access.log.1.gz (rotatecount 2, logstart 1, i 0),
rotating log /var/log/squid3/cache.log, log->rotateCount is 2
dateext suffix '-20140312'
glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'
previous log /var/log/squid3/cache.log.1 does not exist
renaming /var/log/squid3/cache.log.2.gz to /var/log/squid3/cache.log.3.gz (rotatecount 2, logstart 1, i 2),
renaming /var/log/squid3/cache.log.1.gz to /var/log/squid3/cache.log.2.gz (rotatecount 2, logstart 1, i 1),
renaming /var/log/squid3/cache.log.0.gz to /var/log/squid3/cache.log.1.gz (rotatecount 2, logstart 1, i 0),
running prerotate script
running script (multiple) with arg /var/log/squid3/*.log : "
                test ! -x /usr/sbin/sarg-reports || /usr/sbin/sarg-reports
               "
renaming /var/log/squid3/access.log to /var/log/squid3/access.log.1
renaming /var/log/squid3/cache.log to /var/log/squid3/cache.log.1
running postrotate script
running script (multiple) with arg /var/log/squid3/*.log : "
                test ! -e /var/run/squid3.pid || /usr/sbin/squid3 -k rotate
"
removing old log /var/log/squid3/access.log.3.gz
error: error opening /var/log/squid3/access.log.3.gz: file or directory not found

Any idea what can be checked here? Thanks.

Answer 1

As indicated by the log entries, there is an error with the prerotate scripts.

To debug this, one can remove the scripts from the configuration and add them back one by one until the troublesome one is found.

They can also be executed manually to see which one fail but in this case, the OP said they failed silently.

Using logrotate -vf /etc/logrotate.d/squid3 (-v for vervose, -f for force) is another option which in this case helps getting data on the problem.

Good documentation on logrotate can be found here:

• http://www.rackspace.com/knowledge_center/article/understanding-logrotate-part-1
• http://www.rackspace.com/knowledge_center/article/understanding-logrotate-part-2