# logrotate lying about log files

## KWhat

I can't seem to figure this out and I am really starting to dislike logrotate and will consider alternatives if there are any.

/etc/logrotate.d/mail

```

/var/log/mail.err {

    rotate 4

    weekly

    compress

    #notifempty

    #missingok

    #delaycompress

    sharedscripts

    postrotate

        /etc/init.d/postfix reload > /dev/null 2>&1 || true

    endscript

}

```

logrotate --debug --verbose --force /etc/logrotate.d/mail 

```
reading config file /etc/logrotate.d/mail

reading config info for /var/log/mail.err 

Handling 1 logs

rotating pattern: /var/log/mail.err  forced from command line (4 rotations)

empty log files are rotated, old logs are removed

considering log /var/log/mail.err

  log needs rotating

rotating log /var/log/mail.err, log->rotateCount is 4

dateext suffix '-20110902'

glob pattern '-[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]'

renaming /var/log/mail.err.4.gz to /var/log/mail.err.5.gz (rotatecount 4, logstart 1, i 4), 

renaming /var/log/mail.err.3.gz to /var/log/mail.err.4.gz (rotatecount 4, logstart 1, i 3), 

renaming /var/log/mail.err.2.gz to /var/log/mail.err.3.gz (rotatecount 4, logstart 1, i 2), 

renaming /var/log/mail.err.1.gz to /var/log/mail.err.2.gz (rotatecount 4, logstart 1, i 1), 

renaming /var/log/mail.err.0.gz to /var/log/mail.err.1.gz (rotatecount 4, logstart 1, i 0), 

renaming /var/log/mail.err to /var/log/mail.err.1

running postrotate script

running script with arg /var/log/mail.err : "

        /etc/init.d/postfix reload > /dev/null 2>&1 || true

"

compressing log with: /bin/gzip

removing old log /var/log/mail.err.5.gz

error: error opening /var/log/mail.err.5.gz: No such file or directory

```

So, WHERE IS /var/log/mail.err.?.gz BECAUSE ITS NOT IN /var/log, Also /var/log/mail.err never gets rotated, its still 2 gigs.

----------

## cdstealer

Hi,

Maybe that's the issue.. your file is 2Gb.  Take a look at the output of lsof | grep deleted or something of the like (mail or postfix?)  maybe the file handler cannot be closed for logrotate to do its thing?

Also, you could try stopping postfix, moving/deleting the log and restarting, then run logrotate -fv /etc/logrotate.d/mail.

My gut feeling says that if this log file has been 2Gb for a while, then either the FS or logrotate has a limit on the size of file it will handle.

----------

## KWhat

The other issue is that its keeps looking for /var/log/mail.info.?.gz  Where do I remove them from the queue.

----------

## cdstealer

I maybe wrong here, but I thought logrotate always searched /path/to/log.#.gz depending on the rotate value.  So for example, if you have "rotate 5" set, then even if you only have 1 gz file, it will still search for all 5?

----------

