I get "ALERT exited abnormally with [1]" in the syslog from logrotate every Sunday morning. There's no other indication of what might be causing it. I have logrotate-3.7.5-3.fc7. I looked at all the postrotate commands in /etc/logrotate.d and ran them all by hand, and they all exit with 0 status.
Actually, I think I figured out what's causing it. I see this from the output of /etc/cron.daily/logrotate for Sunday: error: error opening /var/log/samba/log.jik-xp2.3.gz: No such file or directory This presumably has something to do with the /var/log/samba/log.* in /etc/logrotate.d/samba. Apparently the logic for excluding the rotated log files themselves from rotation isn't quite right. I've got samba-3.0.24-12.fc7.
The line /var/log/samba/log.* in .etc/logrotate.d/samba is really not ok -- obviously it says to rotate even already rotated files (log.machine.1 will be rotated as log.machine.1.1, etc.). I would say this is a samba configuration issue, because logrotate does exactly what was configured to. The easiest solution I can think of is to configure samba to log into /var/log/samba/%m.log and logrotate /var/log/samba/*.log, /var/log/samba/smbd.log and /var/log/samba/nmbd.log. Does this solve the problem?
If it's a samba configuration issue, then please change the component of the bug to samba and get the samba maintainers to fix it, because I have the default log file settings in my samba configuration file. Personally, I think logrotate should be smart enough to recognize when a wildcard expands into files that are derived (by rotation) from other files expanded from the same wildcard and ignore those files. In fact, I suspect that logrotate already *has* that logic, since isf it didn't, I would get a lot more than one warning when the samba log files are rotated, and the contents of /var/log/samba would be completely messed up by repeated rotation etc., and they're not. That's why I think this is a logrotate issue rather than a samba issue.
Unfortunately the log.* format can't be easily changed, does logrotate support a smarter syntax so that files ending in .[1-9] and .[1-9].gz can be excluded?
Fxied in recent releases.