XMLWordPrintable

Details

    • Bug
    • Resolution: Done
    • Major
    • None
    • 7.0
    • Storage
    • None

    Description

      Post upgrade from XenServer 6.5 SP1 -> XenServer 7.0, I found that /var/log/lastlog was taking 30+ MB of space:

      ls -la /var/log/lastlog*
      -rw-r--r-- 1 root root 38273316 May 24 22:30 /var/log/lastlog
      

      I found that in /etc/logrotate.d/ that no rotation scripts had an entry for /var/log/lastlog, so I added this to /etc/logrotate.d/xenserver:

      [root@CHAMP logrotate.d]# vi xenserver
      /var/log/boot.log
      /var/log/crit.log
      /var/log/daemon.log
      /var/log/kern.log
      /var/log/user.log
      /var/log/lastlog
      {
          missingok
          sharedscripts
          postrotate
              /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
          endscript
      }
      

      After executing logrotate /etc/logrotate-xenserver.conf, I found the file was rotated out – but to a .1 file:

      [root@CHAMP logrotate.d]# ls -la /var/log/lastlog*
      -rw-r--r-- 1 root root        0 May 24 23:08 /var/log/lastlog
      -rw-r--r-- 1 root root 38273316 May 24 22:30 /var/log/lastlog.1
      

      Further investigation, I found two logrotate scripts:

      /etc/logrotate.conf
      and
      /etc/logrotate-xenserver.conf

      Which one should be used as the former has compression and necessary options, but the latter has odd defaults (ie, not leftover from XenServer 6.5 SP1):

      # see "man logrotate" for details
      missingok
      
      # The compressed files are deleted by another script, based on total disc use.
      # Therefore for logrotate we specify a large number.
      rotate 9999
      
      # create new (empty) log files after rotating old ones
      create
      
      # Use sharedscripts for efficiency: if we rotate several files that are written
      # by the same process, send it SIGHUP just once. For syslogd this causes a
      # restart, which the man page says is expensive.
      sharedscripts
      
      # RPM packages drop log rotation information into this directory
      include /etc/logrotate.d
      
      # no packages own wtmp and btmp -- we'll rotate them here
      /var/log/wtmp {
          monthly
          create 0664 root utmp
              minsize 1M
          rotate 1
      }
      
      /var/log/btmp {
          missingok
          monthly
          create 0600 root utmp
          rotate 1
      }
      
      # system-specific logs may be also be configured here.
      

      Clarification would be awesome so I can spread the word!

      --jkbs | @xenfomation

      Attachments

        Activity

          People

            Unassigned Unassigned
            jessebe JK Benedict
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: