logrotate doesn't work for munin after last update on OpenSUSE 11.4

Question

I'm using munin 1.4.5 on OpenSUSE 11.4. Lately logrotate was updated to fix some permission problems and after that complained with

Mar  3 12:15:05 lucien logrotate: error: "/var/log/munin" has insecure permissions. It must be owned and be writable by root only to avoid security problems. Set the "su" directive in the config file to tell logrotate which user/group should be used for rotation.
Mar  3 12:15:05 lucien logrotate: error: error reading /var/log/munin/munin-html.log: Bad file descriptor
Mar  3 12:15:05 lucien logrotate: error: error reading /var/log/munin/munin-limits.log: Bad file descriptor
Mar  3 12:15:05 lucien logrotate: error: error reading /var/log/munin/munin-update.log: Bad file descriptor
Mar  3 12:15:05 lucien logrotate: error: error reading /var/log/munin/munin-graph.log: Bad file descriptor
Mar  3 12:15:05 lucien logrotate: error: error reading /var/log/munin/munin-node.log: Bad file descriptor

So I addded su directives to /etc/logrotate.d/munin and /etc/logrotate.d/munin-node:

/var/log/munin/munin-html.log
/var/log/munin/munin-nagios.log
/var/log/munin/munin-limits.log
/var/log/munin/munin-update.log {
    su munin munin
    daily
    missingok
    rotate 7
    compress
    copytruncate
    notifempty
    create 640 munin munin
}
/var/log/munin/munin-graph.log {
    su munin www
    daily
    missingok
    rotate 7
    compress
    copytruncate
    notifempty
    create 660 munin www
}
/var/log/munin/munin-cgi-graph.log {
    su wwwrun munin
    daily
    missingok
    rotate 7
    compress
    copytruncate
    notifempty
    create 640 wwwrun www
}

/var/log/munin/munin-node.log {
    su munin munin
    daily
    missingok
    rotate 7
    compress
    copytruncate
    notifempty
    create 640 munin munin
}

Now logrotate doesn't rotate anymore.

Mar  5 12:15:05 lucien logrotate: error: error reading /var/log/munin/munin-html.log: Bad file descriptor
Mar  5 12:15:05 lucien logrotate: error: error reading /var/log/munin/munin-limits.log: Bad file descriptor
Mar  5 12:15:05 lucien logrotate: error: error reading /var/log/munin/munin-update.log: Bad file descriptor
Mar  5 12:15:05 lucien logrotate: error: error reading /var/log/munin/munin-graph.log: Bad file descriptor
Mar  5 12:15:05 lucien logrotate: error: error setting owner of /var/log/munin/munin-cgi-graph.log-20120305: Operation not permitted
Mar  5 12:15:05 lucien logrotate: error: error opening /var/log/munin/munin-node.log: Permission denied

An ls -la of /var/log/munin/ is here.

How do I get logrotate to work again with munin?

Answer 1

There's quite a mess in your permissions in /var/log/munin and in your config file. You have different user/group pair for your files and diffrent group/pair in your configuration.

You have 2 choices in order to solve your problem

1. Use default root:root permissions
2. Specify in ALL your munin rules the same user/group pair

First, you can reset permissions recursively with chown :

chown -R USER:GROUP /var/log/munin

After, if you choose the second solution, you'll have to replace all su ... lines with this one :

su USER GROUP

If you choose the first solution, you'll have to remove entirely all su ... lines.

Answer 2

Run logrotate manually as root with '-d' (as debug) and you will see nice talkative outout.

Answer 3

Turns out this was a bug introduced in logrotate-3.7.9-6.9.1 and fixed in logrotate-3.7.9-6.12.1.