1

I have monitored some strange behavior. Every week at logrotate process time, the apache2 daemon script /etc/init.d/apache2 is being rotated as if it was a log file.

The first week it created another file apache2.1 and emptied apache2. The following week it made apache2.2 and apache2.1 and emptied apache2. And so on.

-rwxr-xr-x 1 root root 6461 2015-04-26 06:25 apache2.4
-rwxr-xr-x 1 root root 6461 2015-05-03 06:25 apache2.3
-rwxr-xr-x 1 root root 6461 2015-05-10 06:25 apache2.2
-rwxr-xr-x 1 root root 6461 2015-05-17 06:25 apache2.1
-rwxr-xr-x 1 root root    0 2015-05-24 06:25 apache2

I am not sure if it is an apache update bug or some scheduled job. Here is my log rotation file:

/var/log/apache2/*.log {
        weekly
        missingok
        rotate 52
        compress
        delaycompress
        notifempty
        create 644 root adm
        sharedscripts
        postrotate
                if [ -f "`. /etc/apache2/envvars ; echo ${APACHE_PID_FILE:-/var/run/apache2.pid}`" ]; then
                        /etc/init.d/apache2 reload > /dev/null
                fi
        endscript
}

My apache2 version: 2.2.12

Edit: logrotate.conf

# see "man logrotate" for details
# rotate log files weekly
weekly

# keep 4 weeks worth of backlogs
rotate 4

# create new (empty) log files after rotating old ones
create

# packages drop log rotation information into this directory
include /etc/logrotate.d

# no packages own wtmp, or btmp -- we'll rotate them here
/var/log/wtmp {
    missingok
    monthly
    create 0664 root utmp
    rotate 1
}

/var/log/btmp {
    missingok
    monthly
    create 0660 root utmp
    rotate 1
}
MohammedSimba
  • 359
  • 1
  • 4
  • 15
  • Check all your logrotate configfiles, e.g. with "grep /etc/init.d/apache /etc/logrotate.d/*" to see if there are other entries that are doing this. – Craig Miskell Jun 09 '15 at 09:37
  • 1
    I didn't find any logrotate configuration file containing the "apache2" under /etc/logrotate.d except that one for apache "/etc/logrotate.d/apache2" which i shared its contents in my question :( – MohammedSimba Jun 09 '15 at 10:13
  • The fact the there's an entry for this file in logrotate's status file means logrotate is the one that's doing this. Have you checked /etc/logrotate.conf? – Paul Haldane Jun 10 '15 at 07:06
  • The other possibility I see is that something odd is happening with the expansion of the envvars in the Apache logrotate script. Perhaps worth running the code inside the double quotes in the if statement to see what you get. – Paul Haldane Jun 10 '15 at 07:11
  • I checked logrotate.conf didn't notice anything unsual, i edit the post with the conf content. do you mean to run this one? `. /etc/apache2/envvars ; echo ${APACHE_PID_FILE:-/var/run/apache2.pid}` ? – MohammedSimba Jun 10 '15 at 08:18
  • I found in the /etc/logrotate.d path another file "apache2.bkup", which has the same content as "apache2" file, could this duplicate cause that issue? – MohammedSimba Jun 10 '15 at 08:19

2 Answers2

0

You can check what logrotate do in /var/lib/logrotate.status file. Also check under /etc/cron.d/ directory if any job exist regarding rotate, or check /var/log/cron log. You might find useful to search the /etc directory for files containing apache2 daemon script:

    find /etc/ -type f -exec grep -H '/etc/init.d/apache2' {} \;
  • inside /var/lib/logrotate/status i found record concerning the apache2 daemon file, `"/etc/init.d/apache2" 2015-6-7` , i also tried the `find` statement, but the output was all about "/etc/logrotate.d/apache2" and " /etc/init.d/apache2" no more files, is there any way to check which process or script created/emptied the daemon file? – MohammedSimba Jun 09 '15 at 13:36
  • I also find something, i am not sure if it is causing the problem or why?, there was another backup file under /etc/logrotate for apache, so under that path i have 2 files "apache2" and "apache2.bakup" with same content, could it cause that issue? – MohammedSimba Jun 09 '15 at 13:41
  • Is adm user exists? Check https://www.rudder-project.org/redmine/issues/2379 –  Jun 09 '15 at 14:56
  • I moved the backup file now, rudder doesn't exist, inside the apache2 file, i didn't notice any code for self rotating – MohammedSimba Jun 09 '15 at 15:33
0

I found a backup file in same path "/etc/logrotate.d/apache2_backup", which had the same content as "/etc/logrotate.d/apache2", after I moved it to another location and kept only the original, my issue was fixed.

Still i couldn't understand why 2 files with same content causes apache daemon file to log rotate!

MohammedSimba
  • 359
  • 1
  • 4
  • 15