Logrotate? Where art thou?

[The_Unbeliever]

So a while ago I got a nice surprise on our Smoothwall box, waiting for me.

Thought it was ADSL connectivity at that time

Got this nice little surprise waiting for me this day :

-rw-r--r-- 1 squid squid 2147483647 Sep  6 10:16 access.log
-rw-r--r-- 1 squid squid  499984038 Apr  1 03:08 access.log.0
-rw-r--r-- 1 squid squid  322980184 Mar  1  2011 access.log.1
-rw-r--r-- 1 squid squid  439398911 Feb  1  2011 access.log.2
-rw-r--r-- 1 squid squid  630819061 Jan  1  2011 access.log.3
-rw-r--r-- 1 squid squid  340349999 Nov  1  2010 access.log.4
-rw-r--r-- 1 squid squid  411864088 Oct  1  2010 access.log.5
-rw-r--r-- 1 squid squid  150842463 Sep  1  2010 access.log.6
-rw-r--r-- 1 squid squid  152266326 Jul 31  2010 access.log.7
-rw-r--r-- 1 squid squid   81771403 Jul  1  2010 access.log.8

Tried to force a logrotate, but it failed.

So I did it by hand.

No wonder why squid choked and died...

So... just to get things running again, I did a manual logrotate (didn't have the time to look at why logrotating failed at that time) :

To do a manual logrotate : (Not recommended, but if it's imperative that you get the Smoothie up and running ASAP, then do the following :

The squid logs reside in /var/log/squid


1. Rename access.log to access.log.1 (if you want to keep it, else delete it)

Renaming :

mv access.log access.log.1

Deleting :

rm access.log

2. Rename or delete cache.log as well.

Renaming :

mv cache.log cache.log.1

Deleting :

rm cache.log

3. And the same goes for user_agent.log

Renaming :

mv user_agent.log user_agent.log.1

Deleting :

rm user_agent.log

Now we will create empty files for Squid to use :

touch access.log
touch cache.log
touch user_agent.log

Read and write permissions are already correct, however, we need to change the user and group to squid for logging to work properly :

chown squid *
chgrp squid *

Now you can restart the web proxy, all should be working.

 

[The_Unbeliever]

And now... fixing the logrotate issue :

/etc/logrotate uses /etc/logrotate.conf - which, in turn, references /etc/logrotate.d/*

Opened /etc/logrotate.d/squid with vi, and found that everything was commented out.

# /var/log/squid/access.log {
#     weekly
#     rotate 4
#     copytruncate
#     notifempty
#     missingok
#     nocompress
# }
# /var/log/squid/cache.log {
#     weekly
#     rotate 4
#     copytruncate
#     compress
#     notifempty
#     missingok
#     postrotate
#       /usr/sbin/squid -k rotate -f /var/smoothwall/proxy/squid.conf
#     endscript
# }

A big WTF.

Removed all the comments, ran /etc/logrotate -f again, and the logs rotated.

/var/log/squid/access.log {
     weekly
     rotate 4
     copytruncate
     notifempty
     missingok
     nocompress
}
/var/log/squid/cache.log {
     weekly
     rotate 4
     copytruncate
     compress
     notifempty
     missingok
     postrotate
     /usr/sbin/squid -k rotate -f /var/smoothwall/proxy/squid.conf
     endscript
}

Now, the big question is - what naughty program decided to slip in the comments in the original squid logrotating config file?

That's another story for another time...