ufw logrotate broken

Bug #1530904 reported by Bib
10
This bug affects 2 people
Affects Status Importance Assigned to Milestone
logrotate (Ubuntu)
Confirmed
Undecided
Unassigned

Bug Description

ubuntu 14.04.3 with all updates done.
This morning I enabled ufw full login for a while to track network problem. Later I got warned /var is nearly full. I disabled login then found 3 huge ufw.log kern.log & syslog files 1.2GB each. Wanting to logrotate to make room nothing happens with sudo logrotate /etc/logrotate.conf nor sudo /etc/cron.daily/logrotate although I can see some logs were rotated during past night.
I have seen messages about permissions I can't remember where.

ls -ld /var/log
drwxrwxr-x 14 root syslog 4096 janv. 4 07:44 /var/log

ls -l /var/log/kern*
-rw-r----- 1 syslog adm 1229901824 janv. 4 13:36 /var/log/kern.log
-rw-r----- 1 syslog adm 13373 janv. 4 07:44 /var/log/kern.log.1
-rw-r----- 1 syslog adm 509 déc 27 08:04 /var/log/kern.log.2.gz
-rw-r----- 1 syslog adm 152524 déc 21 07:41 /var/log/kern.log.3.gz
-rw-r----- 1 syslog adm 521 déc 13 07:54 /var/log/kern.log.4.gz

ls -l /var/log/sysl*
-rw-r----- 1 syslog adm 1229910016 janv. 4 16:30 /var/log/syslog
-rw-r----- 1 syslog adm 11305 janv. 4 07:44 /var/log/syslog.1
-rw-r----- 1 syslog adm 748 janv. 3 07:42 /var/log/syslog.2.gz
-rw-r----- 1 syslog adm 692 janv. 2 07:37 /var/log/syslog.3.gz
-rw-r----- 1 syslog adm 719 janv. 1 07:58 /var/log/syslog.4.gz
-rw-r----- 1 syslog adm 691 déc 31 07:50 /var/log/syslog.5.gz
-rw-r----- 1 syslog adm 1504 déc 30 07:38 /var/log/syslog.6.gz
-rw-r----- 1 syslog adm 697 déc 29 08:05 /var/log/syslog.7.gz

ls -l /var/log/ufw*
-rw-r----- 1 syslog adm 1229922304 janv. 4 11:38 /var/log/ufw.log
-rw-r----- 1 syslog adm 5447 janv. 4 00:17 /var/log/ufw.log.1
-rw-r----- 1 syslog adm 380 août 15:29 /var/log/ufw.log.2.gz

cat /etc/logrotate.conf
# see "man logrotate" for details
# rotate log files weekly
weekly

# use the syslog group by default, since this is the owning group
# of /var/log/syslog.
su root syslog

# keep 4 weeks worth of backlogs
rotate 4

# create new (empty) log files after rotating old ones
create

# uncomment this if you want your log files compressed
#compress

# packages drop log rotation information into this directory
include /etc/logrotate.d

# no packages own wtmp, or btmp -- we'll rotate them here
/var/log/wtmp {
    missingok
    monthly
    create 0664 root utmp
    rotate 1
}

/var/log/btmp {
    missingok
    monthly
    create 0660 root utmp
    rotate 1
}

# system-specific logs may be configured here

cat /etc/logrotate.d/ufw
/var/log/ufw.log
{
 rotate 4
 weekly
 missingok
 notifempty
 compress
 delaycompress
 sharedscripts
 postrotate
  invoke-rc.d rsyslog reload >/dev/null 2>&1 || true
 endscript
}

cat /etc/cron.daily/logrotate
#!/bin/sh

# Clean non existent log file entries from status file
cd /var/lib/logrotate
test -e status || touch status
head -1 status > status.clean
sed 's/"//g' status | while read logfile date
do
    [ -e "$logfile" ] && echo "\"$logfile\" $date"
done >> status.clean
mv status.clean status

test -x /usr/sbin/logrotate || exit 0
/usr/sbin/logrotate /etc/logrotate.conf

Bib (bybeu)
summary: - logrotate broken
+ ufw logrotate broken
Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in logrotate (Ubuntu):
status: New → Confirmed
Revision history for this message
Alex Haydock (alexhaydock) wrote :

This is still an issue in Focal (20.04).

I think it is because the "postrotate" line of the default /etc/logrotate.d/ufw file reads:

```
invoke-rc.d rsyslog rotate >/dev/null 2>&1 || true
```

Which will not function on a systemd system.

Using the example from /etc/logrotate.d/rsyslog would work far better. It simply reads:

```
/usr/lib/rsyslog/rsyslog-rotate
```

This runs a shell script shipped with rsyslog which will use systemctl to issue a HUP when rotating on a systemd system, and the old invoke-rc.d method on a system without systemd.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.