Daily mail logrotation?!

[schmidse]

Hello,

it seems that I've got a lack of understanding logrotate on your SLES 10 system. We want a daily logfile of /var/log/mail
IMO it is configured right --> look at the debug-Output of logrotate
Is there anybody out there who can see my misconfiguration?

logrotate -d /etc/logrotate.d/syslog

reading config file /etc/logrotate.d/syslog
reading config info for /var/log/warn /var/log/messages /var/log/allmessages /var/log/localmessages /var/log/firewall
reading config info for /var/log/mail /var/log/mail.info /var/log/mail.warn /var/log/mail.err
reading config info for /var/log/news/news.crit /var/log/news/news.err /var/log/news/news.notice

Handling 3 logs

rotating pattern: /var/log/warn /var/log/messages /var/log/allmessages /var/log/localmessages /var/log/firewall  4194304 bytes (99 rotations)
empty log files are not rotated, old logs are removed
considering log /var/log/warn
  log does not need rotating
considering log /var/log/messages
  log does not need rotating
considering log /var/log/allmessages
  log /var/log/allmessages does not exist -- skipping
considering log /var/log/localmessages
  log does not need rotating
considering log /var/log/firewall
  log /var/log/firewall does not exist -- skipping
not running postrotate script, since no logs were rotated

rotating pattern: /var/log/mail /var/log/mail.info /var/log/mail.warn /var/log/mail.err  after 1 days (7 rotations)
empty log files are rotated, old logs are removed
considering log /var/log/mail
  log needs rotating
considering log /var/log/mail.info
  log needs rotating
considering log /var/log/mail.warn
  log needs rotating
considering log /var/log/mail.err
  log needs rotating
rotating log /var/log/mail, log->rotateCount is 7
glob finding old rotated logs failed
rotating log /var/log/mail.info, log->rotateCount is 7
glob finding old rotated logs failed
rotating log /var/log/mail.warn, log->rotateCount is 7
glob finding old rotated logs failed
rotating log /var/log/mail.err, log->rotateCount is 7
glob finding old rotated logs failed
renaming /var/log/mail to /var/log/mail-20080118
creating new log mode = 0640 uid = 0 gid = 0
renaming /var/log/mail.info to /var/log/mail.info-20080118
creating new log mode = 0640 uid = 0 gid = 0
renaming /var/log/mail.warn to /var/log/mail.warn-20080118
creating new log mode = 0640 uid = 0 gid = 0
renaming /var/log/mail.err to /var/log/mail.err-20080118
creating new log mode = 0640 uid = 0 gid = 0
running postrotate script
running script with arg /var/log/mail /var/log/mail.info /var/log/mail.warn /var/log/mail.err : "
        /etc/init.d/syslog reload
"
compressing log with: /bin/gzip
compressing log with: /bin/gzip
compressing log with: /bin/gzip
compressing log with: /bin/gzip

/etc/logrotate.conf

# see "man logrotate" for details
# rotate log files weekly
weekly

# keep 4 weeks worth of backlogs
rotate 4

# create new (empty) log files after rotating old ones
create

# uncomment this if you want your log files compressed
#compress

# uncomment these to switch compression to bzip2
compresscmd /usr/bin/bzip2
uncompresscmd /usr/bin/bunzip2

# former versions had to have the compresscommand set accordingly
#compressext .bz2

# RPM packages drop log rotation information into this directory
include /etc/logrotate.d

# no packages own wtmp -- we'll rotate them here
#/var/log/wtmp {
#    monthly
#    create 0664 root utmp
#    rotate 1
#}

# system-specific logs may be also be configured here.

/etc/logrotate.d/syslog

/var/log/warn /var/log/messages /var/log/allmessages /var/log/localmessages /var/log/firewall {
    compress
    dateext
    maxage 365
    rotate 99
    missingok
    notifempty
    size +4096k
    create 640 root root
    sharedscripts
    postrotate
        /etc/init.d/syslog reload
    endscript
}

/var/log/mail /var/log/mail.info /var/log/mail.warn /var/log/mail.err {
    compress
    dateext
    daily
    maxage 30
    rotate 7
    nomissingok
    ifempty
    create 640 root root
    sharedscripts
    postrotate
        /etc/init.d/syslog reload
    endscript
}

/var/log/news/news.crit /var/log/news/news.err /var/log/news/news.notice {
    compress
    dateext
    maxage 365
    rotate 99
    missingok
    notifempty
    size +4096k
    create 640 news news
    sharedscripts
    postrotate
        /etc/init.d/syslog reload
    endscript
}

I've already taken the part starting with /var/log/mail* out of the /etc/logrotate.d/syslog into /etc/logrotate.conf
But this doesn't help me. The logfiles with a dateextension haven't been created.

Thanks in advance, if somebody could help us.

Best regards

[falko]

What's the output of

ls -la /etc/logrotate.d

?

[schmidse]

here is the output of ls -la /etc/logrotate.d

total 63
drwxr-xr-x  2 root root  424 Mar 15  2007 .
drwxr-xr-x 78 root root 7096 Sep 12 15:25 ..
-rw-r--r--  1 root root   72 Jun 23  2006 heartbeat
-rw-r--r--  1 root root   42 Jun 23  2006 ldirectord
-rw-r--r--  1 root root  229 Jun 16  2006 net-snmp
-rw-r--r--  1 root root  187 Jun 29  2006 ntp
-rw-r--r--  1 root root  225 Jun 16  2006 openslp-server
-rw-r--r--  1 root root  141 Jun 16  2006 rsync
-rw-r--r--  1 root root  129 Jun 16  2006 scpm
-rw-r--r--  1 root root 1113 Jun 16  2006 syslog
-rw-r--r--  1 root root  551 Jun 16  2006 syslog-ng
-rw-r--r--  1 root root  184 Jun 16  2006 vsftpd
-rw-r--r--  1 root root  134 Jun 16  2006 wtmp
-rw-r--r--  1 root root  140 Jun 16  2006 xdm
-rw-r--r--  1 root root  200 Jun 16  2006 xinetd
-rw-r--r--  1 root root  135 Jul  6  2006 zmd-backend

[falko]

What's in syslog-ng?
Also, I'm not sure if you can put multiple log files in one line in the logrotate configuration, e.g.:

/var/log/mail /var/log/mail.info /var/log/mail.warn /var/log/mail.err {

Try to specify one log file at a time and see if that changes anything.

[schmidse]

here is the content of /etc/logrotate.d/syslog-ng

/var/log/acpid /var/log/NetworkManager {
    compress
    dateext
    maxage 365
    rotate 99
    missingok
    notifempty
    size +4096k
    create 640 root root
    sharedscripts
    postrotate
        /etc/init.d/syslog reload
    endscript
}

falko, i will try your suggestion, but this line was there by default.