Bug 23273

Summary: logrotate goes berzerk and fills /var, uses all inodes
Product: [Retired] Red Hat Linux Reporter: Need Real Name <rick>
Component: logrotateAssignee: Preston Brown <pbrown>
Status: CLOSED WORKSFORME QA Contact: David Lawrence <dkl>
Severity: high Docs Contact:
Priority: medium    
Version: 7.0CC: dr, jarno.huuskonen
Target Milestone: ---   
Target Release: ---   
Hardware: i386   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2001-06-21 20:34:52 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Description Need Real Name 2001-01-04 08:14:53 UTC
Logrotate (using version 3.3 here) can go haywire in /var/log/{mail,news}
and repeatedly gzip already .gzipped files.  This results in an
inordinately large number of gzipped files, consuming all inodes and 
filling /var (using a 380Mb /var here).  This has been confirmed by
a number of other users.

My hypothesis is that setting permissions of 600 on the directory
(which some installations appear to do) causes this behavior.  It could
be a more fundamental logrotate problem, however.

enjoy.

rick

Comment 1 Preston Brown 2001-06-21 20:01:41 UTC
Can you give us a little bit more information on this bug?  In the environment where 
you are having this problem, run "logrotate -v" and attach the output to the bug 
report.


Comment 2 Need Real Name 2001-06-21 20:34:47 UTC
I don't have logrotate running in those environments any more due to this
problem.  I'd find /var full (and these were 512MB /var partitions) due to
/var/log/{mail,news} being filled with thousands and thousands of files named
like:

mail.1.gz.2.gz.1.gz.2.gz
mail.1.gz.2.gz.1.gz.2.gz.1.gz

[and on out with something like 15 gz's in a single name]

It looked to me like logrotate was versioning and gzipping
files it had already versioned and gzipped.  I thought perhaps
the directory permissions (0600) had something to do with it, but
ultimately even changing them to 700 or even 755 didn't seem to
alleviate the problem.

Ultimately I moved to a pair of centralized loghosts running FreeBSD
and using a custom rotation and summarization script instead of logrotate.

Sorry I can't be more helpful.

Rick Bradley (rick@eastcore.net)

Comment 3 Preston Brown 2001-08-24 14:16:07 UTC
Thanks for trying.  We haven't been able to duplicate this and there have been 
no other reports of such behaviour, so I have to assume it is a very esoteric 
bug related somehow to the environment that had been set up.