I'm having a heck of a time getting logrotate to work. I've searched the web and read the directions from various sources and keep coming up with the same tye of errors. Below is my logrotate.conf

# see "man logrotate" for details
# rotate log files daily
daily

# keep 7 days worth of backlogs
rotate 7

# create new (empty) log files after rotating old ones
create

# uncomment this if you want your log files compressed
compress

# RPM packages drop log rotation information into this directory
include /etc/logrotate.d

# no packages own wtmp -- we'll rotate them here
/var/log/wtmp {
weekly
create 0664 root utmp
rotate 3
}

# system-specific logs may be also be configured here.


This is the main errors I'm trying to find out why they are happening.

/usr/sbin/logrotate -vf /etc/logrotate.conf
reading config file /etc/logrotate.conf
error: /etc/logrotate.conf:3 unexpected text
error: /etc/logrotate.conf:4 lines must begin with a keyword or a filename (possibly in double quotes)
error: /etc/logrotate.conf:6 unexpected text
error: /etc/logrotate.conf:7 lines must begin with a keyword or a filename (possibly in double quotes)
error: /etc/logrotate.conf:9 unexpected text
error: /etc/logrotate.conf:10 lines must begin with a keyword or a filename (possibly in double quotes)
error: /etc/logrotate.conf:12 unexpected text
error: /etc/logrotate.conf:13 lines must begin with a keyword or a filename (possibly in double quotes)
including /etc/logrotate.d
error: Ignoring named.rpmnew, because of .rpmnew ending
error: Ignoring syslog.rpmorig, because of .rpmorig ending
error: Ignoring rpm.rpmnew, because of .rpmnew ending
error: Ignoring cups.rpmnew, because of .rpmnew ending
reading config file cups
reading config info for /var/log/cups/*_log
reading config file exim
reading config info for /var/log/exim_mainlog
reading config info for /var/log/exim_paniclog
reading config info for /var/log/exim_rejectlog
reading config file httpd
reading config info for /var/log/httpd/*log
error: httpd:1 lines must begin with a keyword or a filename (possibly in double quotes)
error: httpd:2 unexpected text
error: httpd:3 unexpected text
error: httpd:4 unexpected text
error: httpd:5 unexpected text
error: httpd:6 unexpected text
error: httpd:7 unexpected text
error: httpd:8 unexpected text
error: httpd:9 unexpected text
error: httpdrerotate or postrotate without endscript


Does anyone have any ideas, I've been trying to figure this out now for 2 days.

Appreciate any input
Thanks in advance

BTW I'm running Apache 1.3.33, on a linux server with WHM cPanel 10.x

Which logs are you attempting to rotate and how often do you want them to rotate?

The logrotate.d directory has the following files in it
cups
cups.rpmnew
exim
httpd
mgetty
mysql
named
named.rpmnew
psaacct
redhat-conf-network
rpm
rpm-rpmnew
samba
snmpd
squid
syslog
syslog.rpmorig
tux
upsdate

I am assuming by the config file that it is calling this directory and running all the different files. What I don't understand is that if I move the first lines I'm getting errors on, that the line numbers change also to the new positions.

I might be incorrect, but I think I saw similar errors when I first had a server and played with logrotate. I made the mistake of editing the conf files (and other logrotate files) with a text editor in Windows and then FTP'ing them to the server. Instead of editing in situ on the server with pico. I think the former mthod adds extra characters that logrotate doesn't like, and I believe those were the sort of error messages I was getting.

I finally figured that out, I ran it from the command prompt now and it seems to be working.
Now there must be something else wrong because when I received the email with the results this am I got the following errors.

error: Ignoring named.rpmnew, because of .rpmnew ending
error: Ignoring syslog.rpmorig, because of .rpmorig ending
error: Ignoring rpm.rpmnew, because of .rpmnew ending
error: Ignoring cups.rpmnew, because of .rpmnew ending
error: bad line 80 in state file /var/lib/logrotate.status
/etc/cron.daily/tmpwatch:

error: failed to unlink /tmp/ixed: ixed.lin.4.0.6.pxp
error: failed to unlink /tmp/ixed: ixed.lin.4.1.2.pxp
error: failed to unlink /tmp/ixed: ixed.lin.4.2.3.pxp
error: failed to unlink /tmp/ixed: ixed.lin.4.2.ts.pxp
error: failed to unlink /tmp/ixed: ixed.lin.4.3.2.pxp
error: failed to unlink /tmp/ixed: ixed.lin.4.3.4.pxp
error: failed to unlink /tmp/ixed: ixed.lin.4.3.ts.pxp
error: failed to unlink /tmp/ixed: ixed.lin.4.3.5.pxp
error: failed to unlink /tmp/ixed: ixed.lin.4.3.3.pxp
error: failed to unlink /tmp/ixed: ixed.lin.4.3.1.pxp
error: failed to unlink /tmp/ixed: ixed.lin.4.3.0.pxp
error: failed to unlink /tmp/ixed: ixed.lin.4.2.2.pxp
error: failed to unlink /tmp/ixed: ixed.lin.4.2.1.pxp
error: failed to unlink /tmp/ixed: ixed.lin.4.2.0.pxp
error: failed to unlink /tmp/ixed: ixed.lin.4.1.1.pxp
error: failed to unlink /tmp/ixed: ixed.lin.4.1.0.pxp
error: failed to unlink /tmp/ixed: ixed.fre.4.1.2.pxp
error: failed to unlink /tmp/ixed: ixed.fre.4.2.3.pxp
error: failed to unlink /tmp/ixed: ixed.fre.4.3.3.pxp
error: failed to unlink /tmp/ixed: ixed.fre.4.3.0.pxp
error: failed to unlink /tmp/ixed: ixed.fre.4.3.1.pxp
error: failed to unlink /tmp/ixed: ixed.fre.4.3.2.pxp
error: failed to unlink /tmp/ixed: ixed.fre.4.3.4.pxp
error: failed to unlink /tmp/ixed: ixed.fre.4.3.5.pxp
error: failed to unlink /tmp/ixed: ixed.fre.4.2.2.pxp
error: failed to unlink /tmp/ixed: ixed.fre.4.2.1.pxp
error: failed to unlink /tmp/ixed: ixed.fre.4.2.0.pxp
error: failed to unlink /tmp/ixed: ixed.fre.4.1.0.pxp
error: failed to unlink /tmp/ixed: ixed.fre.4.1.1.pxp
error: failed to unlink /tmp/ixed: ixed.lin.4.3.6.pxp
error: failed to unlink /tmp/ixed: ixed.lin.4.3.7.pxp
error: failed to unlink /tmp/ixed: ixed.fre.4.3.6.pxp
error: failed to unlink /tmp/ixed: ixed.fre.4.3.7.pxp
error: failed to unlink /tmp/ixed: ixed.lin.4.3.8.pxp
error: failed to unlink /tmp/ixed: ixed.fre.4.3.8.pxp
error: failed to unlink /tmp/ixed: ixed.lin.4.3.9.pxp
error: failed to unlink /tmp/ixed: ixed.fre.4.3.9.pxp
error: failed to unlink /var/tmp/ixed: ixed.lin.4.0.6.pxp
error: failed to unlink /var/tmp/ixed: ixed.lin.4.1.2.pxp
error: failed to unlink /var/tmp/ixed: ixed.lin.4.2.3.pxp
error: failed to unlink /var/tmp/ixed: ixed.lin.4.2.ts.pxp
error: failed to unlink /var/tmp/ixed: ixed.lin.4.3.2.pxp
error: failed to unlink /var/tmp/ixed: ixed.lin.4.3.4.pxp
error: failed to unlink /var/tmp/ixed: ixed.lin.4.3.ts.pxp
error: failed to unlink /var/tmp/ixed: ixed.lin.4.3.5.pxp
error: failed to unlink /var/tmp/ixed: ixed.lin.4.3.3.pxp
error: failed to unlink /var/tmp/ixed: ixed.lin.4.3.1.pxp
error: failed to unlink /var/tmp/ixed: ixed.lin.4.3.0.pxp
error: failed to unlink /var/tmp/ixed: ixed.lin.4.2.2.pxp
error: failed to unlink /var/tmp/ixed: ixed.lin.4.2.1.pxp
error: failed to unlink /var/tmp/ixed: ixed.lin.4.2.0.pxp
error: failed to unlink /var/tmp/ixed: ixed.lin.4.1.1.pxp
error: failed to unlink /var/tmp/ixed: ixed.lin.4.1.0.pxp
error: failed to unlink /var/tmp/ixed: ixed.fre.4.1.2.pxp
error: failed to unlink /var/tmp/ixed: ixed.fre.4.2.3.pxp
error: failed to unlink /var/tmp/ixed: ixed.fre.4.3.3.pxp
error: failed to unlink /var/tmp/ixed: ixed.fre.4.3.0.pxp
error: failed to unlink /var/tmp/ixed: ixed.fre.4.3.1.pxp
error: failed to unlink /var/tmp/ixed: ixed.fre.4.3.2.pxp
error: failed to unlink /var/tmp/ixed: ixed.fre.4.3.4.pxp
error: failed to unlink /var/tmp/ixed: ixed.fre.4.3.5.pxp
error: failed to unlink /var/tmp/ixed: ixed.fre.4.2.2.pxp
error: failed to unlink /var/tmp/ixed: ixed.fre.4.2.1.pxp
error: failed to unlink /var/tmp/ixed: ixed.fre.4.2.0.pxp
error: failed to unlink /var/tmp/ixed: ixed.fre.4.1.0.pxp
error: failed to unlink /var/tmp/ixed: ixed.fre.4.1.1.pxp
error: failed to unlink /var/tmp/ixed: ixed.lin.4.3.6.pxp
error: failed to unlink /var/tmp/ixed: ixed.lin.4.3.7.pxp
error: failed to unlink /var/tmp/ixed: ixed.fre.4.3.6.pxp
error: failed to unlink /var/tmp/ixed: ixed.fre.4.3.7.pxp
error: failed to unlink /var/tmp/ixed: ixed.lin.4.3.8.pxp
error: failed to unlink /var/tmp/ixed: ixed.fre.4.3.8.pxp
error: failed to unlink /var/tmp/ixed: ixed.lin.4.3.9.pxp
error: failed to unlink /var/tmp/ixed: ixed.fre.4.3.9.pxp

Now I need to see what is causing this.

The .rpmnew/.rpmorig messages are just warnings. When the logrotate package is updated it will not replace your logrotate configuration. Instead it will just place them in the configuration directory with the .rpmnew extension. The .rpmorig occurs when the package update forces a config replacement. It then places the original file in the configuration directory with the .rpmorig extension.

As for the other errors, it appears that your rotation is attempting to clear out the ixed files in your '/tmp' directory. However, these files appear to be in use, thus they cannot be removed. They are probably being used by cPanel. Did you place those files in the '/tmp' directory to correct an ixed error in Fantastico?

No I didn't put them there at all. I guess that is where cPanel must of put them.

I went thru all the files in the /etc/cron.daily/logrotate: and did not find anything with a tmp directory in them.

The only mention of /tmp is in the logrotate.cnf which is below

# no packages own wtmp -- we'll rotate them here
/var/log/wtmp {
weekly
create 0664 root utmp
rotate 3
}

Any ideas would be appreciated

I apologize. I misread the output from your previous post. It appears that the '/etc/cron.daily/tmpwatch' scripts is reporting the ixed errors.

Well I'm lost on this one

the tmpwatch script contains the following

/usr/sbin/tmpwatch 240 /tmp
/usr/sbin/tmpwatch 720 /var/tmp
for d in /var/{cache/man,catman}/{cat?,X11R6/cat?,local/cat?}; do
if [ -d "$d" ]; then
/usr/sbin/tmpwatch -f 720 $d
fi
done

I looked at the /tmp and only see some sess_ files and some username_session- files. Also there are cpanel.TMP.********** and 1 cache_************files.

I see where the username_session files that are in there are very large.

Does any of this make sense?