Why are system logs not rotating?

Question

logrotate.conf says rotate logs weekly, but my logs haven't rotated for 5 weeks. What could be stopping my logs from rotating?

Logrotate.conf:

# rotate log files weekly
weekly

# keep 4 weeks worth of backlogs
rotate 4

# create new (empty) log files after rotating old ones
create

size 100M

# uncomment this if you want your log files compressed
#compress

# packages drop log rotation information into this directory
include /etc/logrotate.d

# no packages own wtmp, or btmp -- we'll rotate them here
/var/log/wtmp {
    missingok
    monthly
    create 0664 root utmp
    rotate 1
}

/var/log/btmp {
    missingok
    monthly
    create 0660 root utmp
    rotate 1
}

There is no state file

sudo logrotate -f /etc/logrotate.conf produces

error: error creating output file /var/log/syslog.1.gz: File exists
error: error creating output file /var/log/daemon.log.1.gz: File exists
error: error creating output file /var/log/kern.log.1.gz: File exists
error: error creating output file /var/log/auth.log.1.gz: File exists
error: error creating output file /var/log/user.log.1.gz: File exists
error: error creating output file /var/log/debug.1.gz: File exists
error: error creating output file /var/log/messages.1.gz: File exists

After deleting these files the logrotate rotated the logs, so I guess that solved my problem, thanks, though I can't think why logrotate couldn't handle it

Answer 1

1. Show us your logrotate.conf.
2. Delete your state file /var/lib/logrotate.status and
3. do logrotate -f /etc/logrotate.conf as root. Post back any error messages.
4. You are running logrotate as a cron job? As root?

Answer 2

I know I'm a little late to the game here, but since I found a reason for this not working for me, I wanted to help others:

This happened to me too, and I discovered a resolution yesterday.

Check to see if any of the compressed files (particularly all the *.1.gz fiels) have 0 bytes?

Technically this file exists, but the script sees it as empty, and therefore ignores it. Then tries to create this file - but can't as you can see above.

Delete the empty compressed files. Then go to /var/lib/logrotate.status and edit the dates for each of these files, so that logrotate thinks it is more than a week since it checked the files. I would recommend just changing the month back one.

Then run logrotate again and the script should run correctly.

Answer 3

My jessie systems had /etc/logrotate.conf installed belonging to pi and with permissions of 664 so logrotate refused to process it. Fixed with:

/bin/chown root.root /etc/logrotate.conf /bin/chmod 600 /etc/logrotate.conf /usr/sbin/logrotate -v /etc/logrotate.conf

Answer 4

Really late to the party, on this one... but this happened to me because I had a bunch of rotated logs (*.[1-9].gz) files, and then /etc/logrotate.d/rsyslog with a "delaycompress" directive. I'm assuming that I either had updated it to that, at some point, or that a later revision "fixed" that problem.

So, essentially none of the *.1.gz should have actually existed, and it was confusing logrotate. Removing the files (many of them 0-sized) and re-running logrotate, manually, fixed the problem.