Fedora Account System
Red Hat Associate
Red Hat Customer
Description of problem: With every run (manually or triggered by timer) certbot rotates old log files and creates a new one. Old log files are _never_ cleaned up. Version-Release number of selected component (if applicable): 1.27.0-1 How reproducible: Always. Steps to Reproduce: 1. Install python3-certbot 2. Run `certbot renew` in a loop (like certbot-renew.timer does) 3. See the number of log files grow with every execution Actual results: Uncontrolled growth in number of log files Expected results: Like for other services, log files should be cleaned up eventually. Additional info: That's what I have in /etc/logrotate.d/certbot: # Certbot opens a new logfile on every run. # Old log files are rotated, but not cleaned. # This should do the cleaning bit. # Tune 'maxage' to adjust for how long to keep old logs. /var/log/letsencrypt/*.log { rotate 0 weekly missingok maxage 15 nocreate nocompress nodateext start 1 } Of course, the 'maxage' value can be adjusted for the file shipped with the package. Seeing that in the default settings, old log files are removed after four rotations, setting it to 28 or 35 might be a good choice.
Above configuration does not work as intended. I changed it to: /var/log/letsencrypt/*.log { rotate -1 weekly missingok maxage 15 create nocompress nodateext start 1 } That creates an empty letsencrypt.log file post creation, which will be rotated immediately the next time certbot is run. But above configuration does take care of removing old log files based on `maxage`.
Hmm, I think certbot will rotate its logs once there are more than 1000 files. This is at least what the docs say: https://eff-certbot.readthedocs.io/en/stable/using.html#log-rotation Do you have more than 1000 log files? Does using "--max-log-backups" help?
I wasn't aware of the internal log rotation default, nor the '--max-log-backups' option. However, 1000 log files means, roughly, 500 days of logs before rotation. That's a very conservative setting. Most of them are just telling you that the certificate is not yet due for renewal. Moreover, systemd also keeps that information (see 'journalctl -eu certbot-renew.service'). So, that's a lot of duplication. How about using '--max-log-backups 0' by default and letting logrotate handle the rotation? Debian and Ubuntu appear to handle it that way, I gather from the docs you pointed to.
This message is a reminder that Fedora Linux 35 is nearing its end of life. Fedora will stop maintaining and issuing updates for Fedora Linux 35 on 2022-12-13. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as EOL if it remains open with a 'version' of '35'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, change the 'version' to a later Fedora Linux version. Thank you for reporting this issue and we are sorry that we were not able to fix it before Fedora Linux 35 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora Linux, you are encouraged to change the 'version' to a later version prior to this bug being closed.
Since f35 and f36 carry the same version of certbot and I haven't seen any changes implementing proper log rotation, I'm setting version to 36.
FEDORA-2023-1f48a3b1a6 has been submitted as an update to Fedora 39. https://bodhi.fedoraproject.org/updates/FEDORA-2023-1f48a3b1a6
FEDORA-2023-1f48a3b1a6 has been pushed to the Fedora 39 stable repository. If problem still persists, please make note of it in this bug report.