1 Topic by lug

  • lug
  • Member
  • Offline
  • Registered: 2016-12-07
  • Posts: 147

Topic: mail.log empty after logrotate

==== Required information ====
- iRedMail version (check /etc/iredmail-release): 0.9.7
- Linux/BSD distribution name and version: ubuntu 16.04
- Store mail accounts in which backend (LDAP/MySQL/PGSQL):
- Web server (Apache or Nginx):
- Manage mail accounts with iRedAdmin-Pro?
- [IMPORTANT] Related original log or error message is required if you're experiencing an issue.
====

Hi, my mail.log rotate is weeky, but everytime it rotates the new log file stays empty.
why is that?

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2 Reply by lug

  • lug
  • Member
  • Offline
  • Registered: 2016-12-07
  • Posts: 147

Re: mail.log empty after logrotate

Ok it seems like syslog is borken for some reason

Oct 22 06:25:33 mail rsyslogd: message repeated 4 times: [ [origin software="rsyslogd" swVersion="8.16.0" x-pid="6848" x-info="http://www.rsyslog.com"] rsyslogd was HUPed]
Oct 23 06:25:37 mail rsyslogd: [origin software="rsyslogd" swVersion="8.16.0" x-pid="6848" x-info="http://www.rsyslog.com"] exiting on signal 15.
Oct 23 06:25:37 mail rsyslogd: [origin software="rsyslogd" swVersion="8.16.0" x-pid="12634" x-info="http://www.rsyslog.com"] start
Oct 23 06:25:37 mail rsyslogd-2222: command 'KLogPermitNonKernelFacility' is currently not permitted - did you already set it via a RainerScript command (v6+ config)? [v8.16.0 try http://www.rsyslog.com/e/2222 ]
Oct 23 06:25:37 mail rsyslogd: rsyslogd's groupid changed to 108
Oct 23 06:25:37 mail rsyslogd: rsyslogd's userid changed to 104
Oct 23 06:25:37 mail systemd[1]: Stopping System Logging Service...
Oct 23 06:25:37 mail systemd[1]: Stopped System Logging Service.
Oct 23 06:25:37 mail systemd[1]: Starting System Logging Service...
Oct 23 06:25:37 mail rsyslogd-2039: Could not open output pipe '/dev/xconsole':: No such file or directory [v8.16.0 try http://www.rsyslog.com/e/2039 ]
Oct 23 06:25:37 mail rsyslogd-2007: action 'action 15' suspended, next retry is Mon Oct 23 06:26:07 2017 [v8.16.0 try http://www.rsyslog.com/e/2007 ]
Oct 23 06:25:37 mail systemd[1]: Started System Logging Service.
Oct 23 06:25:37 mail rsyslogd: [origin software="rsyslogd" swVersion="8.16.0" x-pid="12634" x-info="http://www.rsyslog.com"] exiting on signal 15.
Oct 23 06:25:37 mail rsyslogd: [origin software="rsyslogd" swVersion="8.16.0" x-pid="12648" x-info="http://www.rsyslog.com"] start
Oct 23 06:25:37 mail rsyslogd-2222: command 'KLogPermitNonKernelFacility' is currently not permitted - did you already set it via a RainerScript command (v6+ config)? [v8.16.0 try http://www.rsyslog.com/e/2222 ]
Oct 23 06:25:37 mail rsyslogd: rsyslogd's groupid changed to 108
Oct 23 06:25:37 mail rsyslogd: rsyslogd's userid changed to 104
Oct 23 06:25:37 mail systemd[1]: Stopping System Logging Service...
Oct 23 06:25:37 mail systemd[1]: Stopped System Logging Service.
Oct 23 06:25:37 mail systemd[1]: Starting System Logging Service...
Oct 23 06:25:37 mail systemd[1]: Started System Logging Service.
Oct 23 06:25:37 mail rsyslogd-2039: Could not open output pipe '/dev/xconsole':: No such file or directory [v8.16.0 try http://www.rsyslog.com/e/2039 ]
Oct 23 06:25:37 mail rsyslogd-2007: action 'action 15' suspended, next retry is Mon Oct 23 06:26:07 2017 [v8.16.0 try http://www.rsyslog.com/e/2007 ]
Oct 23 06:25:37 mail rsyslogd: [origin software="rsyslogd" swVersion="8.16.0" x-pid="12648" x-info="http://www.rsyslog.com"] exiting on signal 15.
Oct 23 06:25:38 mail rsyslogd: [origin software="rsyslogd" swVersion="8.16.0" x-pid="12663" x-info="http://www.rsyslog.com"] start
Oct 23 06:25:38 mail rsyslogd-2222: command 'KLogPermitNonKernelFacility' is currently not permitted - did you already set it via a RainerScript command (v6+ config)? [v8.16.0 try http://www.rsyslog.com/e/2222 ]
Oct 23 06:25:38 mail rsyslogd: rsyslogd's groupid changed to 108
Oct 23 06:25:38 mail rsyslogd: rsyslogd's userid changed to 104
Oct 23 06:25:37 mail systemd[1]: Stopping System Logging Service...
Oct 23 06:25:37 mail systemd[1]: Stopped System Logging Service.
Oct 23 06:25:38 mail systemd[1]: Starting System Logging Service...
Oct 23 06:25:38 mail rsyslogd-2039: Could not open output pipe '/dev/xconsole':: No such file or directory [v8.16.0 try http://www.rsyslog.com/e/2039 ]
Oct 23 06:25:38 mail rsyslogd-2007: action 'action 15' suspended, next retry is Mon Oct 23 06:26:08 2017 [v8.16.0 try http://www.rsyslog.com/e/2007 ]
Oct 23 06:25:38 mail systemd[1]: Started System Logging Service.
Oct 23 06:25:38 mail rsyslogd: [origin software="rsyslogd" swVersion="8.16.0" x-pid="12663" x-info="http://www.rsyslog.com"] exiting on signal 15.
Oct 23 06:25:38 mail rsyslogd: [origin software="rsyslogd" swVersion="8.16.0" x-pid="12677" x-info="http://www.rsyslog.com"] start
Oct 23 06:25:38 mail rsyslogd-2222: command 'KLogPermitNonKernelFacility' is currently not permitted - did you already set it via a RainerScript command (v6+ config)? [v8.16.0 try http://www.rsyslog.com/e/2222 ]
Oct 23 06:25:38 mail rsyslogd: rsyslogd's groupid changed to 108
Oct 23 06:25:38 mail rsyslogd: rsyslogd's userid changed to 104
Oct 23 06:25:38 mail systemd[1]: Stopping System Logging Service...
Oct 23 06:25:38 mail systemd[1]: Stopped System Logging Service.
Oct 23 06:25:38 mail systemd[1]: Starting System Logging Service...
Oct 23 06:25:38 mail rsyslogd-2039: Could not open output pipe '/dev/xconsole':: No such file or directory [v8.16.0 try http://www.rsyslog.com/e/2039 ]
Oct 23 06:25:38 mail rsyslogd-2007: action 'action 15' suspended, next retry is Mon Oct 23 06:26:08 2017 [v8.16.0 try http://www.rsyslog.com/e/2007 ]
Oct 23 06:25:38 mail systemd[1]: Started System Logging Service.
Oct 23 06:25:38 mail rsyslogd: [origin software="rsyslogd" swVersion="8.16.0" x-pid="12677" x-info="http://www.rsyslog.com"] exiting on signal 15.
Oct 23 06:25:38 mail rsyslogd: [origin software="rsyslogd" swVersion="8.16.0" x-pid="12690" x-info="http://www.rsyslog.com"] start
Oct 23 06:25:38 mail rsyslogd-2222: command 'KLogPermitNonKernelFacility' is currently not permitted - did you already set it via a RainerScript command (v6+ config)? [v8.16.0 try http://www.rsyslog.com/e/2222 ]
Oct 23 06:25:38 mail rsyslogd: rsyslogd's groupid changed to 108
Oct 23 06:25:38 mail rsyslogd: rsyslogd's userid changed to 104
Oct 23 06:25:38 mail systemd[1]: Stopping System Logging Service...
Oct 23 06:25:38 mail systemd[1]: Stopped System Logging Service.
Oct 23 06:25:38 mail systemd[1]: Starting System Logging Service...
Oct 23 06:25:38 mail rsyslogd-2039: Could not open output pipe '/dev/xconsole':: No such file or directory [v8.16.0 try http://www.rsyslog.com/e/2039 ]
Oct 23 06:25:38 mail rsyslogd-2007: action 'action 15' suspended, next retry is Mon Oct 23 06:26:08 2017 [v8.16.0 try http://www.rsyslog.com/e/2007 ]
Oct 23 06:25:38 mail systemd[1]: Started System Logging Service.
Oct 23 06:25:38 mail rsyslogd: [origin software="rsyslogd" swVersion="8.16.0" x-pid="12690" x-info="http://www.rsyslog.com"] exiting on signal 15.

3 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 31,163

Re: mail.log empty after logrotate

lug wrote:

Oct 23 06:25:37 mail rsyslogd-2039: Could not open output pipe '/dev/xconsole':: No such file or directory [v8.16.0 try http://www.rsyslog.com/e/2039 ]

Open file /etc/rsyslog.d/50-default.conf, comment out the last few lines which contains '/dev/xconsole'.

4 Reply by lug

  • lug
  • Member
  • Offline
  • Registered: 2016-12-07
  • Posts: 147

Re: mail.log empty after logrotate

Thanks, I'll try that and see if the next rotate works smile

5 Reply by lug (edited by lug 2017-10-30 17:22:20)

  • lug
  • Member
  • Offline
  • Registered: 2016-12-07
  • Posts: 147

Re: mail.log empty after logrotate

Didn't work sad
File was empty after logrotate.

47 6    * * 7   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )

so logrotate should be 6:47 on sunday

syslog.1 ends like this:

Oct 29 06:26:17 mail postfix/qmgr[11528]: 6FF481A0898: removed
Oct 29 06:26:17 mail postfix/qmgr[11528]: 95ED31A0808: removed
Oct 29 06:26:17 mail freshclam[1122]: Received signal: re-opening log file
Oct 29 06:26:17 mail freshclam[1122]: ClamAV update process started at Sun Oct 29 06:26:17 2017
Oct 29 06:26:17 mail freshclam[1122]: main.cvd is up to date (version: 58, sigs: 4566249, f-level: 60, builder: sigmgr)
Oct 29 06:26:17 mail freshclam[1122]: daily.cld is up to date (version: 23997, sigs: 1765803, f-level: 63, builder: neo)
Oct 29 06:26:17 mail freshclam[1122]: bytecode.cld is up to date (version: 313, sigs: 73, f-level: 63, builder: neo)
Oct 28 06:26:15 mail rsyslogd: message repeated 5 times: [ [origin software="rsyslogd" swVersion="8.16.0" x-pid="21914" x-info="http://www.rsyslog.com"] rsyslogd was HUPed]
Oct 29 06:26:17 mail rsyslogd: [origin software="rsyslogd" swVersion="8.16.0" x-pid="21914" x-info="http://www.rsyslog.com"] exiting on signal 15.
Oct 29 06:26:17 mail rsyslogd: [origin software="rsyslogd" swVersion="8.16.0" x-pid="29369" x-info="http://www.rsyslog.com"] start
Oct 29 06:26:17 mail rsyslogd: rsyslogd's groupid changed to 108
Oct 29 06:26:17 mail rsyslogd: rsyslogd's userid changed to 104
Oct 29 06:26:17 mail systemd[1]: Stopping System Logging Service...
Oct 29 06:26:17 mail systemd[1]: Stopped System Logging Service.
Oct 29 06:26:17 mail systemd[1]: Starting System Logging Service...
Oct 29 06:26:17 mail systemd[1]: Started System Logging Service.
Oct 29 06:26:17 mail rsyslogd: [origin software="rsyslogd" swVersion="8.16.0" x-pid="29369" x-info="http://www.rsyslog.com"] exiting on signal 15.
Oct 29 06:26:17 mail rsyslogd: [origin software="rsyslogd" swVersion="8.16.0" x-pid="29385" x-info="http://www.rsyslog.com"] start
Oct 29 06:26:17 mail rsyslogd: rsyslogd's groupid changed to 108
Oct 29 06:26:17 mail rsyslogd: rsyslogd's userid changed to 104
Oct 29 06:26:17 mail systemd[1]: Stopping System Logging Service...
Oct 29 06:26:17 mail systemd[1]: Stopped System Logging Service.
Oct 29 06:26:17 mail systemd[1]: Starting System Logging Service...
Oct 29 06:26:17 mail systemd[1]: Started System Logging Service.
Oct 29 06:26:17 mail rsyslogd: [origin software="rsyslogd" swVersion="8.16.0" x-pid="29385" x-info="http://www.rsyslog.com"] exiting on signal 15.
Oct 29 06:26:17 mail rsyslogd: [origin software="rsyslogd" swVersion="8.16.0" x-pid="29399" x-info="http://www.rsyslog.com"] start
Oct 29 06:26:17 mail systemd[1]: Stopping System Logging Service...
Oct 29 06:26:17 mail rsyslogd: rsyslogd's groupid changed to 108
Oct 29 06:26:17 mail rsyslogd: rsyslogd's userid changed to 104
Oct 29 06:26:17 mail systemd[1]: Stopped System Logging Service.
Oct 29 06:26:17 mail systemd[1]: Starting System Logging Service...
Oct 29 06:26:17 mail systemd[1]: Started System Logging Service.
Oct 29 06:26:18 mail rsyslogd: [origin software="rsyslogd" swVersion="8.16.0" x-pid="29399" x-info="http://www.rsyslog.com"] exiting on signal 15.
Oct 29 06:26:18 mail rsyslogd: [origin software="rsyslogd" swVersion="8.16.0" x-pid="29413" x-info="http://www.rsyslog.com"] start
Oct 29 06:26:18 mail rsyslogd: rsyslogd's groupid changed to 108
Oct 29 06:26:18 mail rsyslogd: rsyslogd's userid changed to 104
Oct 29 06:26:18 mail systemd[1]: Stopping System Logging Service...
Oct 29 06:26:18 mail systemd[1]: Stopped System Logging Service.
Oct 29 06:26:18 mail systemd[1]: Starting System Logging Service...
Oct 29 06:26:18 mail systemd[1]: Started System Logging Service.
Oct 29 06:26:18 mail rsyslogd: [origin software="rsyslogd" swVersion="8.16.0" x-pid="29413" x-info="http://www.rsyslog.com"] exiting on signal 15.
Oct 29 06:26:18 mail rsyslogd: [origin software="rsyslogd" swVersion="8.16.0" x-pid="29427" x-info="http://www.rsyslog.com"] start
Oct 29 06:26:18 mail rsyslogd: rsyslogd's groupid changed to 108
Oct 29 06:26:18 mail rsyslogd: rsyslogd's userid changed to 104
Oct 29 06:26:18 mail systemd[1]: Stopping System Logging Service...
Oct 29 06:26:18 mail systemd[1]: Stopped System Logging Service.
Oct 29 06:26:18 mail systemd[1]: Starting System Logging Service...
Oct 29 06:26:18 mail systemd[1]: Started System Logging Service.
Oct 29 06:26:18 mail postfix/postscreen[11550]: CONNECT from [***]:34767 to [***]:25
Oct 29 06:26:18 mail postfix/postscreen[11550]: WHITELISTED [***]:34767
Oct 29 06:26:18 mail postfix/smtpd[29073]: connect from unknown[***]
Oct 29 06:26:18 mail postfix/smtpd[29073]: Anonymous TLS connection established from unknown[***]: TLSv1 with cipher AES128-SHA (128/128 bits)
Oct 29 06:26:18 mail postfix/smtpd[29073]: 59FF51A0BD6: client=unknown[***]
Oct 29 06:26:18 mail postfix/cleanup[29093]: 59FF51A0BD6: message-id=<***>
Oct 29 06:26:18 mail postfix/qmgr[11528]: 59FF51A0BD6: from=<>, size=31578, nrcpt=1 (queue active)
Oct 29 06:26:18 mail postfix/smtpd[29073]: disconnect from unknown[***] ehlo=2 starttls=1 mail=1 rcpt=1 data=1 quit=1 commands=7
Oct 29 06:26:18 mail rsyslogd: [origin software="rsyslogd" swVersion="8.16.0" x-pid="29427" x-info="http://www.rsyslog.com"] exiting on signal 15.

The new syslog file is empty then.

6 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 31,163

Re: mail.log empty after logrotate

lug wrote:
47 6    * * 7   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )

so logrotate should be 6:47 on sunday

The log you pasted doesn't contain log at 6:47.