4

After installing a new CentOS 6.0 server, logrotate was working absolutely fine. Then one day due to a kernel panic, the server had to be hard booted, and ever since log rotation is not rotating the logs.

So I did a separate cron entry to rotate logs manually and forcefully and redirected the output to a log file, and got the following lines for each file:

rotating pattern: /home/mail3/log/popMailProcessing.log  forced from command line (60 rotations)
empty log files are rotated, old logs are removed
considering log /home/mail3/log/popMailProcessing.log
error: stat of /home/mail3/log/popMailProcessing.log failed: Permission denied

However, if I do a logrotation manually from command line, it works flawlessly. The command I use on command line is:

logrotate -v -f /etc/logrotate.d/mail3-logs

My logrotate.conf file is:

# see "man logrotate" for details
# rotate log files weekly
weekly

# keep 4 weeks worth of backlogs
rotate 4

# create new (empty) log files after rotating old ones
create

# use date as a suffix of the rotated file
dateext

# uncomment this if you want your log files compressed
compress

# RPM packages drop log rotation information into this directory
include /etc/logrotate.d

# no packages own wtmp and btmp -- we'll rotate them here
/var/log/wtmp {
    monthly
    create 0664 root utmp
        minsize 1M
    rotate 1
}

/var/log/btmp {
    missingok
    monthly
    create 0600 root utmp
    rotate 1
}

# system-specific logs may be also be configured here.

The log rotation file which logrotate uses via cron job is:

dateext
/home/mail3/log/pop.log {
        daily
        rotate 60
        copytruncate
        compress
}
/home/mail3/log/oc4j.log {
        daily
        rotate 60
        copytruncate
        compress
}
/home/mail3/log/incoming.log {
        daily
        rotate 60
        copytruncate
        compress
}
/home/mail3/log/mailpro.log {
        daily
        rotate 60
        copytruncate
        compress
}
/home/mail3/log/imap.log {
        daily
        rotate 60
        copytruncate
        compress
}
/home/mail3/log/outgoing.log {
        daily
        rotate 60
        copytruncate
        compress
}
/home/mail3/log/smtpout.log {
        daily
        rotate 60
        copytruncate
        compress
}
/home/mail3/log/retry.log {
        daily
        rotate 60
        copytruncate
        compress
}
/home/mail3/log/mailinglist.log {
        daily
        rotate 60
        copytruncate
        compress
}
/home/mail3/log/migrate.log {
        daily
        rotate 60
        copytruncate
        compress
}

My crontab entry is:

03 00 * * * root /usr/sbin/logrotate -f -v /etc/logrotate.d/mail3-logs &>> /var/log/logrotate/rotate.log

SELinux is enforcing, and it was enforcing prior to the hard boot too. The directory where the logs are kept have the root as their owner and directory has complete permissions.

Any clue what is causing the permission denied error?

5

Your original error messages make no sense with what you're showing for your cron that runs your logrotate.

rotating pattern: /home/mail3/log/popMailProcessing.log  forced from command line (60 rotations)
empty log files are rotated, old logs are removed
considering log /home//log/popMailProcessing.log
error: stat of /home/mail3/log/popMailProcessing.log failed: Permission denied

What are these paths doing going to /home/mail3/log/*? Also what's missing from the /home//log/popMailProcessing.log line? Seems like you're only showing some of the actual situation in your question.

Debugging the issue

Put this line in a shell script, logrotate.sh:

#!/bin/bash
/usr/sbin/logrotate -f -v /etc/logrotate.d/mail3-logs &>> /var/log/logrotate/rotate.log

Make it executable and run it like this from the cron:

03 00 * * * root strace -s 2000 -o /tmp/strace.log /path/to/logrotate.bash

In going through the output you should see what is getting tripped up by the permissions problems.

EDIT #1

After conversing with the OP he mentioned that the above debugging technique uncovered that SELinux was enabled. He was perplexed as to why this was the case since he had previously disabled it with the command setenforce 0.

Disabling SELinux in this fashion will only remain in this state until the next reboot. The default mode for SELinux is dictated by this file on Fedora/CentOS:

$ cat /etc/sysconfig/selinux
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#   enforcing - SELinux security policy is enforced.
#   permissive - SELinux prints warnings instead of enforcing.
#   disabled - SELinux is fully disabled.
SELINUX=disabled
# SELINUXTYPE= type of policy in use. Possible values are:
#   targeted - Only targeted network daemons are protected.
#   strict - Full SELinux protection.
SELINUXTYPE=targeted

To permanently disable SELinux you'll want to change the line SELINUX=.. to one of the 3 states, enforcing, permissive, disabled.

I would encourage you however to take the time to understand why SELinux is disallowing the access to the directory these log files are within, and add the appropriate context's so that SELinux allows this access. SELinux is an important part of the layered security model that is facilitated on Linux distros that make use of it, and blindly disabling it is taking one of the critical layers away.

References

  • mail3 is an instance of a mail app. I have corrected the path. As of these errors are the only output I have been able to get out of the situation. If there is some more info that is needed, please tell me about it, I'll get it. – Gautam Somani Mar 21 '14 at 18:45
  • 1
    @GautamSomani - I would wrap the logrotate ... command in a shell script and run strace -s 2000 -o /tmp/strace.log logrotate.sh from cron to see what's having issues with the permissions. – slm Mar 21 '14 at 18:47
  • Yes, it was the selinux being enforced which caused the problem. Disabling it solved the prob. But how did a hardboot caused this problem when earlier too it was enforcing!? Any light on that? – Gautam Somani Mar 22 '14 at 11:20
  • @GautamSomani - how did you disable it? If you setenforce 0 this only hold for the current boot, a reboot will revert to whatever it was set to prior. There's another method if you need to make it disabled permanently. Rather then disable it though you should be able to find the context that needs to get added to the filesystem and just add them. – slm Mar 22 '14 at 12:00
  • I did use setenforce 0, and will set the context, but I still don't understand that why did the hardboot cause the selinux to deny the permission. Any clue about that? – Gautam Somani Mar 22 '14 at 14:16
4

I think disabling SELinux is not the best option. The better solution, in my opinion, is to create and apply policy. Here is an example of how to do it for other policy http://www.greenvalleyconsulting.org/2015/01/28/installing-coldfusion-11-on-centos-6-6-with-selinux-enforcing/. The same concept will apply to logrotate_t policy instead of httpd_t as outlined in link.

See steps to install policycoreutils-python in the link. then run

grep logrotate /var/log/audit/audit.log | audit2why

audit2allow -a

look for logrotate_t, it more likely will look like this

#============= logrotate_t ============== 
allow logrotate_t file_t:file getattr;

then run

audit2allow -a -M logrotate_t

semodule -i logrotate_t.pp

chcon -R -t logrotate_t /[your log file location]/*.log

  • 1
    this was more applicable to my situation - thanks for sharing this. I didn't want to disable SELinux completely as suggested in the earlier responses. – Ejoso Mar 5 '16 at 19:51
2

In a pinch, you can work around this with:

semanage permissive -a logrotate_t

That's offered in the logrotate_selinux man page.

You'll still be able to see the messages (that you should eventually address) with audit2allow.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.