I made the logrotation/webalizer changes exactly as shown in a post on the Sun/Cobalt forum, the box did not blow up, I've got 8 consecutive days of stats, an amazing accomplishment IMHO, <G> but I am getting a small error notice from the log rotation cron every morning now..

Subject: errors rotating logs
errors occured while rotating /var/log/xferlog Failed to remove old log /var/log/xferlog.2: No such file or directory

I posted to the Sun forum 4 days ago with [sadly] not one reply..
Does anyone have any ideas on this??

here is the post describing the modifications made:
I've assumed that webalizer is started from /etc/cron.daily/webalizer.pl so you may need to alter the location if you are launching it from a different location.

SSH and su to root

pico /etc/logrotate.d/apache
remark the three script lines that call split_logs. It should read something like:


# prerotate
# /usr/local/sbin/split_logs web < /var/log/httpd/access
# endscript
control-x and save


We need to move the cron jobs out of the way for now:


mkdir /etc/cron.daily.old
mv /etc/cron.daily/logrotate /etc/cron.daily.old/logrotate
mv /etc/cron.daily/webalizer.pl /etc/cron.daily.old/webalizer.pl
Now to add the cron jobs ad different times:


pico /etc/crontab
I've opted to start split_logs at 12:30am, webalizer.pl at 3:30am and to rotate the logs at 5:30am. This should allow enough time to complete the previous job on full RaQs with large sites.

Add the section:

# Webalizer and Log Rotate
30 0 * * * root /usr/local/sbin/split_logs web < /var/log/httpd/access
30 3 * * * root /etc/cron.daily.old/webalizer.pl
30 5 * * * root /usr/sbin/logrotate /etc/logrotate.conf


You must restart crond:
/etc/rc.d/init.d/crond restart

You will need to wait a few days before you see a result.

Can you please post the following:

/etc/logrotate.d/apache

/etc/crontab

the results of ls in the following directories:

/etc/cron.daily
/etc/cron.daily.old

I went home early yesterady and could not look at this for you.

OK here ya go.. now there was some things I did not do here.. as he said.. like I had webalizer in cron.quarter daily on somone elses advice - his thinking was if it ran 4 times daily it would not lose stats.. and we all know that taint so! At some point I renamed it to awebalizer.pl to make it run before log rotating, that didn't have any effect. I also know from experience that if you move the webalizer.pl it makes a royal mess and you lose all back stats.. so that part I did not do from this other guys instructions, I left it where it was in 1/4 daily and changed the times to call 1/4 daily to once a day at 2.30a

I did however move logrotate to cron. hold

[root /etc]# ls -la cron.hold
total 6
drwxrwxr-x 2 root root 1024 Jul 16 10:19 .
drwxr-xr-x 41 root root 4096 Jul 25 11:57 ..
-rwxr-xr-x 1 root root 51 Apr 25 2000 logrotate

here is everything else you asked for..

/etc/logrotate.d/apache

/var/log/httpd/access {
# prerotate
# /usr/local/sbin/split_logs web < /var/log/httpd/access
# endscript
missingok
postrotate
/usr/bin/killall -HUP httpd 2> /dev/null || true
endscript
daily
}

/var/log/httpd/agent_log {
missingok
postrotate
/usr/bin/killall -HUP httpd 2> /dev/null || true
endscript
}

/var/log/httpd/error {
missingok
postrotate
/usr/bin/killall -HUP httpd 2> /dev/null || true
endscript
}

/var/log/httpd/referer_log {
missingok
postrotate
/usr/bin/killall -HUP httpd 2> /dev/null || true
endscript
}

/var/log/httpd/fpexec_log {
missingok
postrotate
/usr/bin/killall -USR1 httpd 2> /dev/null || true
endscript
}

/var/log/httpd/suexec_log {
missingok
postrotate
/usr/bin/killall -USR1 httpd 2> /dev/null || true
endscript
}

-------------------
/etc/crontab

SHELL=/bin/bash
PATH=/sbin:/bin:/usr/sbin:/usr/bin
MAILTO=root
HOME=/

# run-parts
01 * * * * root run-parts /etc/cron.hourly
02 4 * * * root run-parts /etc/cron.daily
22 4 * * 0 root run-parts /etc/cron.weekly
42 4 1 * * root run-parts /etc/cron.monthly
10 4,14 * * * root run-parts /etc/cron.half-daily
0,15,30,45 * * * * root run-parts /etc/cron.quarter-hourly

30 2 * * * root /usr/local/sbin/split_logs web < /var/log/httpd/access
20 3 * * * root run-parts /etc/cron.quarter-daily
30 4 * * * root /usr/sbin/logrotate /etc/logrotate.conf

# Monitor services to make sure everything is still okay.
0,15,30,45 * * * * root /usr/local/sbin/swatch >>/var/cobalt/adm.log 2>&1

================
etc/cron.daily

drwxr-xr-x 2 root root 1024 Jul 16 10:19 .
drwxr-xr-x 41 root root 4096 Jul 25 11:57 ..
-rwxr-xr-x 1 root root 15664 Jan 3 2002 clean
-rwx------ 1 root root 55 Apr 22 23:39 kavlogrotate
-rwx------ 1 root root 258 Apr 22 23:39 kavupdater
-rwxr-xr-x 1 root root 402 Jul 27 2000 makewhatis.cron
-rwxr-xr-x 1 root root 99 Dec 18 2000 slocate.cron
-rwxr-xr-x 1 root root 226 May 10 08:26 tmpwatch
-rwxr-xr-x 1 root root 221 Oct 5 2000 tmpwatch.orig

Subject: errors rotating logs
errors occured while rotating /var/log/xferlog Failed to remove old log /var/log/xferlog.2: No such file or directory

What's in your /etc/logrotate.conf ?

The xferlog.2 .3 .4 etc are the logs from 2, 3, 4 etc days ago...

can you post your "ls -la /etc/log" ? might be a permissions problem or perhaps another script is removing it before logrotate gets to it etc...

Dave

/etc/logrotate.conf
# see "man logrotate" for details
# rotate log files weekly
weekly

# keep 4 weeks worth of backlogs
rotate 1

# send errors to root
errors root

# create new (empty) log files after rotating old ones
create

# uncomment this if you want your log files compressed
compress

# Put in a generic size limit so things don't go wild
size 1M

# RPM packages drop log rotation information into this directory
include /etc/logrotate.d

# no packages own lastlog or wtmp -- we'll rotate them here
/var/log/wtmp {
monthly
size 2M
create 0664 root root
rotate 1
}

# system-specific logs may be configured here

------------------------------
ls -la /etc/log <<-- does not exist.. think you meant /var/log

[root admin]# ls -la /var/log/
total 7714
drwxr-xr-x 3 root root 1024 Jul 26 05:08 .
drwxr-xr-x 19 root root 1024 Jun 14 15:20 ..
-rw------- 1 root root 916193 Jul 26 07:56 auth
-rw------- 1 root root 11 Jul 26 07:45 auth.offset
-rw-r--r-- 1 root root 0 Nov 1 2001 boot.log
-rw------- 1 root root 599619 Jul 26 07:45 cron
-rw------- 1 root root 83996 Jul 6 04:45 cron.1.gz
-rw-r--r-- 1 root root 3319 Jun 14 15:20 dmesg
lrwxrwxrwx 1 root root 15 Nov 1 2001 httpd -> /home/log/httpd
-rw-rw-r-- 1 root root 2506767 Jul 26 07:56 kavscan.rpt
-rw-rw-r-- 1 root root 216584 Jul 24 04:34 kavscan.rpt.1.gz
-rw-r--r-- 1 root root 30812 Jul 26 07:55 kernel
-rw-r--r-- 1 root root 85077 Jul 26 04:58 kernel.1.gz
-rw-r--r-- 1 root root 146292 Jul 26 07:56 lastlog
-rw------- 1 root root 139201 Jul 26 07:56 maillog
-rw------- 1 root root 2699 Jul 26 05:08 maillog.1.gz
-rw------- 1 root root 1078206 Jul 1 02:53 maillog.save
-rw------- 1 root root 475888 Jul 26 07:56 messages
-rw------- 1 root root 118958 Jul 24 05:06 messages.1.gz
-rw------- 1 root root 11 Jul 26 07:45 messages.offset
-rwx------ 1 postgres postgres 0 Jul 21 05:08 postgresql
-rwx------ 1 postgres postgres 33 Jul 21 04:36 postgresql.1.gz
-rwx------ 1 postgres postgres 33 Jul 14 05:00 postgresql.2.gz
drwx------ 2 root root 1024 May 23 2001 samba
-rw------- 1 root root 582772 Jul 26 07:51 secure
-rw------- 1 root root 114652 Jul 23 05:06 secure.1.gz
-rw------- 1 root root 11 Jul 26 07:45 secure.offset
-rw------- 1 root root 0 Nov 1 2001 spooler
-rw-rw-r-- 1 root root 860928 Jul 26 07:56 wtmp
-rw-r--r-- 1 root nobody 0 Jul 26 05:05 xferlog
-rw-r--r-- 1 root nobody 0 Jul 26 04:30 xferlog.1

Oops, you are right, I did mean /var/log ..

I don't have any RAQs nor have I used them ... could someone who knows tell us if you have xferlog.1, xferlog.2, xferlog.3, xferlog.4 in your /var/log/ directory - if not where ?

Also is xferlog supposed to have gid "nobody" ??

Hmmm, It's got to be something simple - I just can't see it yet .. you get your error email sent to you at 4:30 right?

Dave

humm actually they come between 5.02 & 5.05AM, rotating starts at 4.30a so I would have to assume here that its taking 1.2 hr to complete the job??