Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #211604 > unrolled thread

Re: Debian 10 logrotate

Back to article view | Back to linux.debian.user

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: Debian 10 logrotate Sven Joachim <svenjoac@gmx.de> - 2019-07-21 12:00 +0200
    Re: Debian 10 logrotate Étienne Mollier <etienne.mollier@mailoo.org> - 2019-07-21 12:50 +0200
    Re: Debian 10 logrotate Gene Heskett <gheskett@shentel.net> - 2019-07-25 08:10 +0200

#211604 — Re: Debian 10 logrotate

On 2019-07-21 02:42 +0000, Tan Shao Yi wrote:

> I upgraded to Debian 10 recently and it looks like logrotate is not
> working on files outside the /var directory:

This is correct.

> For example,
>
> Jul 21 00:00:01 server-name logrotate[8874]: error: error renaming
> /usr/local/apache/logs/https-error_log.12.gz to
> /usr/local/apache/logs/https-error_log.13.gz: Read-only file system
> Jul 21 00:00:03 server-name logrotate[8874]: error: unable to open /usr/local/backup/mysql/mysql.sql.1 for compression
>
> The files are present, and I am able to logrotate them manually as
> root when I run logrotate against the config files in
> /etc/logrotate.d--it just fails when it is run automatically.
>
> May I know if something has changed recently to cause this?

It is the ProtectSystem=full directive in logrotate.service which causes
/usr to be mounted read-only for logrotate.  See the SANDBOXING section
in systemd.exec(5).

You can make /usr/local writable with
"systemctl edit logrotate.service", enter the following line:

ReadWritePaths=/usr/local

in your editor and you're done.

Cheers,
       Sven

[toc] | [next] | [standalone]

#211606

[Multipart message — attachments visible in raw view] — view raw

Sven Joachim, on 2019-07-21:
> On 2019-07-21 02:42 +0000, Tan Shao Yi wrote:
> > May I know if something has changed recently to cause this?
>
> It is the ProtectSystem=full directive in logrotate.service which causes
> /usr to be mounted read-only for logrotate.  See the SANDBOXING section
> in systemd.exec(5).

So it was a Systemd subtlety indeed.  Never mind my previous
email Tan Shao Yi.

> You can make /usr/local writable with
> "systemctl edit logrotate.service", enter the following line:
>
> ReadWritePaths=/usr/local

The culprit was ProtectHome= on my side.  I moved data outside
/home, to clear things up since then.

Thank you for your insights Sven!
-- 
Étienne Mollier <etienne.mollier@mailoo.org>
               5AB1 4EDF 63BB CCFF 8B54 2FA9 59DA 56FE FFF3 882D

[toc] | [prev] | [next] | [standalone]

#211724

On Wednesday 24 July 2019 21:04:13 Tan Shao Yi wrote:

> Hi Sven,
>
> Thank you for the explanation.
>
> I just wanted to add that when doing "systemctl edit
> logrotate.service", we also need to include the "[Service]" header
> before specifying ReadWritePaths.
>
> Thank you.
>
> Regards,
> Tan Shao Yi
>
> On 21/7/19, 5:55 PM, "Sven Joachim" <svenjoac@gmx.de> wrote:
>
>     On 2019-07-21 02:42 +0000, Tan Shao Yi wrote:
>     > I upgraded to Debian 10 recently and it looks like logrotate is
>     > not working on files outside the /var directory:
>
>     This is correct.

This is going to be a problem for me unless its fixable. My email logs 
were moved to /home/me/log many years ago because I got tired of 
fighting with somebody's idea of security denying fetchmail and procmail 
rights to keep their logs in /var. Logrotate was easily fixed then. And 
I believe its fixed for the stretch I'm running atm.


>     > For example,
>     >
>     > Jul 21 00:00:01 server-name logrotate[8874]: error: error
>     > renaming /usr/local/apache/logs/https-error_log.12.gz to
>     > /usr/local/apache/logs/https-error_log.13.gz: Read-only file
>     > system Jul 21 00:00:03 server-name logrotate[8874]: error:
>     > unable to open /usr/local/backup/mysql/mysql.sql.1 for
>     > compression
>     >
>     > The files are present, and I am able to logrotate them manually
>     > as root when I run logrotate against the config files in
>     > /etc/logrotate.d--it just fails when it is run automatically.
>     >
>     > May I know if something has changed recently to cause this?
>
>     It is the ProtectSystem=full directive in logrotate.service which
> causes /usr to be mounted read-only for logrotate.  See the SANDBOXING
> section in systemd.exec(5).
>
>     You can make /usr/local writable with
>     "systemctl edit logrotate.service", enter the following line:
>
>     ReadWritePaths=/usr/local
>
>     in your editor and you're done.
>
>     Cheers,
>            Sven


Cheers, Gene Heskett
-- 
"There are four boxes to be used in defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
If we desire respect for the law, we must first make the law respectable.
 - Louis D. Brandeis
Genes Web page <http://geneslinuxbox.net:6309/gene>

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web