porteus logrotate: ALERT - exited abnormally.

[Rava]

The error as listed in /var/log/messages

Code: Select all

Sep 15 19:19:44 porteus syslogd[763]: -- MARK --
Sep 15 19:30:01 porteus logrotate: ALERT - exited abnormally.
Sep 15 19:59:45 porteus syslogd[763]: -- MARK --

I tried researching the issue and found a post on LQ where a user said in that specific case it was due to the mail log growing too big (1.2GB alone on a 1.5 GB partition) and thus logrotate being unable to compress the original.
https://www.linuxquestions.org/question ... 1]-747571/

well it's nothing at all to do with logrotate from what I can see. I mean, there's the reason the file got so big, and the reason that logrotate is giving those errors, and the latter will be disk space most likely

In contrast to that find I do not have a mailserver running and the issue should be with either /var/log/messages itself or with Xorg.0.log or lastlog since these are the only logs larger than 100 kB.

Here is what I have free on / and what's in /var/log

Code: Select all

guest@rava:/var/log$ ls -o --time-style=long-iso --quoting-style=shell | cut -c 20-$(expr 19 + $(tput cols))

112423 2023-09-15 17:06 Xorg.0.log
     0 2022-12-11 09:45 btmp
  2373 2023-09-15 19:30 cron
 12154 2023-09-13 18:17 debug
 61538 2023-09-08 13:27 dmesg
     0 2021-02-13 12:15 faillog
292292 2023-09-08 13:30 lastlog
     0 2021-12-04 21:20 maillog
458787 2023-09-16 01:59 messages
     3 2021-06-15 20:38 nfsd
    24 2023-03-02 17:28 packages -> ../lib/pkgtools/packages
    62 2023-03-02 17:28 pkgtools
  2488 2023-09-08 15:26 porteus-livedbg
    25 2022-07-10 09:42 removed_packages -> pkgtools/removed_packages
    24 2022-07-10 09:42 removed_scripts -> pkgtools/removed_scripts
    34 2022-07-10 09:42 removed_uninstall_scripts -> pkgtools/removed_uninstall_
     3 2022-12-07 13:57 samba
    23 2023-03-02 17:28 scripts -> ../lib/pkgtools/scripts
  8077 2023-09-10 16:39 secure
    21 2023-03-02 17:28 setup -> ../lib/pkgtools/setup
 40263 2023-09-15 17:06 syslog
  3840 2023-09-08 13:30 wtmp
guest@rava:/var/log$ df -Tm .
Filesystem     Type 1M-blocks  Used Available Use% Mounted on
aufs           aufs       388   253       135  66% /

So, I have 135 MB free on /
The largest logs (un-logrotated) - meaning uncompressed are:
448.03 KB messages
285.44 KB lastlog
109.79 KB Xorg.0.log

I did not change the settings of logrotate (I presume it is set up via cron?) - thus it should run in its default settings.

And here is /var/lib/logrotate.status

Code: Select all

guest@rava:/var/log$ cat /var/lib/logrotate.status 
logrotate state -- version 2
"/var/log/syslog" 2023-9-8-19:0:0
"/var/log/debug" 2023-9-8-19:0:0
"/var/log/wtmp" 2023-9-8-19:0:0
"/var/log/spooler" 2023-9-8-19:0:0
"/var/log/btmp" 2023-9-8-19:0:0
"/var/log/maillog" 2023-9-8-19:0:0
"/var/log/wpa_supplicant.log" 2023-9-8-19:0:0
"/var/log/secure" 2023-9-8-19:0:0
"/var/log/messages" 2023-9-8-19:0:0
"/var/log/cron" 2023-9-8-19:0:0

Does it try to compress one log at a time (then there should be no free space issue on / ) or could it be it tries to compress messages & lastlog & Xorg.0.log in one go?

But even then, together uncompressed these three files are approx 843.26 KB while I have 135 MB free on / - so the free space needed on / should not be the issue for logrotate even when it would try to compress all three files at once.

Any ideas why logrotate exited abnormally ?

Added in 6 minutes 51 seconds:
This post https://unix.stackexchange.com/question ... sing-files was not helpful at all.


Update
The original issue was solved due to a reboot, but it happened again. See here: [SOLVED by itself] porteus logrotate: ALERT - exited abnormally. (Post by Rava #96662)

[Vic]

Hi Rava.

I Experienced a similar problem as stated in
https://www.linuxquestions.org/question ... 5D-747571/ while i was using MX linux.

The /home/.xsession-errors file was huge. I ended up using a script to eliminate the problem, but I have no idea whether issues were caused elswhere.

The files are in Gdrive if you would like to view them.

https://drive.google.com/drive/folders/ ... sp=sharing

Good luck

Vic

[Ed_P]

What does your /etc/logrotate.conf look like Rava?

[Rava]

@Vic
What exactly was the cause for your issues and what was the solution? If it could be said in a few sentences.
────────────────────────────────────

What does your /etc/logrotate.conf look like Rava?

Code: Select all

guest@rava:/$ ls -o /etc/logrotate.conf 
-rw-r--r-- 1 root 1549 2021-05-21 20:56 /etc/logrotate.conf
guest@rava:/$ ls -o /mnt/live/memory/images/001-core.xzm/etc/logrotate.conf
-rw-r--r-- 1 root 1549 2021-05-21 20:56 /mnt/live/memory/images/001-core.xzm/etc/logrotate.conf

As you can see, it is the unaltered version from 001-core.xzm :

Code: Select all

guest@rava:~$ cat /etc/porteus/*
001-core.xzm:20221211
002-xorg.xzm:20221211
002-xtra.xzm:20221211
003-xfce.xzm:20220925
initrd.xz:20220928

Here its contents:

Code: Select all

# /etc/logrotate.conf
#
# logrotate is designed to ease administration of systems that generate large
# numbers of log files.  It allows automatic rotation, compression, removal, and
# mailing of log files.  Each log file may be handled daily, weekly, monthly, or
# when it grows too large.
#
# logrotate is normally run daily from root's crontab.
#
# For more details, see "man logrotate".

# rotate log files weekly:
weekly

# keep 4 weeks worth of backlogs:
rotate 4

# create new (empty) log files after rotating old ones:
create

# don't rotate empty log files
notifempty

# uncomment if you want to use the date as a suffix of the rotated file
#dateext

# uncomment this if you want your log files compressed:
#compress

# uncomment this to put rotated logs in "oldlogs" subdir  
# this is relative to the original dir of the to-be-rotated file
# You can use a full path here, but beware of identically-named
# logfiles in different directories, e.g. httpd logs
#olddir oldlogs

# some packages install log rotation information in this directory:
include /etc/logrotate.d

# Rotate /var/log/wtmp:
/var/log/wtmp {
    monthly
    create 0664 root utmp
	minsize 1M
    rotate 1
}

# Rotate /var/log/btmp:
/var/log/btmp {
    monthly
    create 0600 root root
    rotate 1
}

# Note that /var/log/lastlog is not rotated.  This is intentional, and it should
# not be.  The lastlog file is a database, and is also a sparse file that takes
# up much less space on the drive than it appears.

# system-specific logs may be also be configured below:

To be sure it is 100% the original Port version, here the md5sums

Code: Select all

guest@rava:~$ md5sum /mnt/live/memory/images/001-core.xzm/etc/logrotate.conf /etc/logrotate.conf
7bea0663634285e39b7f71be60ea0e84  /mnt/live/memory/images/001-core.xzm/etc/logrotate.conf
7bea0663634285e39b7f71be60ea0e84  /etc/logrotate.conf

Added in 4 minutes 51 seconds:

Code: Select all

guest@rava:~$ ls -o /etc/logrotate.d
total 2
-rw-r--r-- 1 root 321 2022-12-11 09:47 syslog
-rw-r--r-- 1 root 281 2022-12-11 09:47 syslog.orig
-rw-r--r-- 1 root 100 2022-01-19 18:16 wpa_supplicant

Don't ask me why there is a syslog and a syslog.orig .
I never edited any of these files in my current system.

[Vic]

Hi Rava.

I have no idea what caused the /home/.xsession-errors file to get so big - 2.5 Gib. After a Duck search i found the info on a website - forgot where - and made a script following the instructions. The script does not fix anything, just deletes stuff.

I cannot reproduce the problem because it happened in an old version of MX. For me it was a magic pill.

I was hoping you might find something useful from my files.

Vic

[Rava]

^
The only files in /home/guest/ connected to X are these:

Code: Select all

guest@rava:~$ du -h .serverauth.1760 .Xauthority 
4.0K	.serverauth.1760
4.0K	.Xauthority
guest@rava:~$ ls -l .serverauth.1760 .Xauthority 
-rw------- 1 guest users  63 2023-09-08 13:29 .Xauthority
-rw------- 1 guest users 126 2023-09-08 13:29 .serverauth.1760

and the sizes are of no concern.

I start Porteus in init mode 3 (Slackware standard, virtual text terminal, network, multiuser) and log in as guest and start x manually via

Code: Select all

startx

but that cannot be the reason for any issues.

Added in 1 minute 20 seconds:

I was hoping you might find something useful from my files.

For now, i do not know what causes the error since all files in /var/log/ are not that large and logrotate should be able to easily compress these.

Even when you approach is not working for my issue, maybe it is still helpful for other Port users lurking here.

Added in 1 day 11 hours 9 minutes 44 seconds:
In them meantime logrotate must have been successful:

Code: Select all

root@rava:/var/log# ls -o *gz
-rw-r----- 1 root 51720 2023-09-17 19:20 messages.1.gz
root@rava:/var/log# 

Still no clue why it failed and what caused the fail as described in the initial post.

[Vic]

Hi Rava.

Hope your problem is gone, but I read this in the MX forums and thought of you.

https://forum.mxlinux.org/viewtopic.php?t=76426

I do not know what any of the suggestions mean but you might. Meant for MX but many things are shared.

Vic

[Rava]

@Vic
I did not ignore the contents of any log files, and the size of the 3 largest have not been the issue as well. (when I compare the log file sizes with the available space on the aufs of / )

The issue resolved itself some days later without me having changed anything. More details in this post above:

In them meantime logrotate must have been successful:

I have no clue what the reason for

Code: Select all

porteus logrotate: ALERT - exited abnormally.

was and again what was the reason it then worked by itself a few days later without me changing anything.

I had to reboot due to some other unrelated issue and not encountered the issue since then.

Sometimes it might sound illogical, but when a program misbehaves and then all works well, I think it is just not up to us to understand why the one time it went off the rails.

[Ed_P]

I think it is just not up to us to understand why the one time it went off the rails.

But it's who we are. We must understand the why and how so we can prevent it in the future.

[Rava]

But it's who we are. We must understand the why and how so we can prevent it in the future.

True, but when you have not a single hint of what caused an issue and no one can give you helpful pointers and the issue is no longer there, how much time and energy would you invest into a seemingly senseless examination?

[Rava]

Once more it happened again:

Code: Select all

Oct 21 19:11:43 porteus syslogd[785]: -- MARK --
Oct 21 19:30:01 porteus logrotate: ALERT - exited abnormally.
Oct 21 19:51:43 porteus syslogd[785]: -- MARK --

I only saw this much later. the file size of /var/log/messages when I saw the issue:

Code: Select all

root@rava:~# /bin/ls -o --time-style=long-iso /var/log/messages | cut -c 19-$(expr 18 + $(tput cols))
356365 2023-10-22 04:21 /var/log/messages

348.01 KB for /var/log/messages again, cannot be an size issue. And when I found out my / was more filled than I liked still not too full for logrotate to have any issues:

Code: Select all

root@rava:~# df -Tm /
Filesystem     Type 1M-blocks  Used Available Use% Mounted on
aufs           aufs       388   336        52  87% /

52 MB free is enough of free space for an 348.01 KB log to be logrotated.

I presume Telegram is using more of / than all my previous regularly ran programs.

Code: Select all

guest@rava:~/.local/share$ du -scm */ .??*/ 2>/dev/null |sort -nr
190	total
190	TelegramDesktop/
1	xfce4/
1	mc/
1	icons/
1	gvfs-metadata/
1	dbus-1/
1	clipit/
1	applications/
0	nemo/
0	Mousepad/

as I suspected. Found you, messenger fiend!

(the home folder of interlink is via symlink redirected to a folder on a ext3 partition of the internal drive) .

I check out which folders use much of / . In the past the largest aside from Palemoon have been thumbnails but not this time:

Code: Select all

guest@rava:~/.cache$ du -scm */ .??*/ 2>/dev/null |sort -nr
14	total
11	moonchild productions/
2	binary outcast/
1	yt-dlp/
1	transmission/
1	thumbnails/
1	samba/
1	mc/
1	fontconfig/
0	sessions/

Or maybe the slapt-mod databases are an issue? (Because I could purge these, when doing so on the Telegram files would get me into troubles.)

Code: Select all

guest@rava:/var$ du -scm */ .??*/ 2>/dev/null |sort -nr
21	total
14	slapt-get/
7	lib/
1	spool/
1	run/
1	lock/
1	db/
1	cache/
1	adm/
0	tmp/
0	state/
0	man/
0	mail/
0	empty/

Only 14 MB. Hardly worth a purge, but a small gain is still a gain.