I have monitored some strange behavior. Every week at logrotate process time, the apache2 daemon script /etc/init.d/apache2 is being rotated as if it was a log file.
The first week it created another file apache2.1 and emptied apache2. The following week it made apache2.2 and apache2.1 and emptied apache2. And so on.
-rwxr-xr-x 1 root root 6461 2015-04-26 06:25 apache2.4
-rwxr-xr-x 1 root root 6461 2015-05-03 06:25 apache2.3
-rwxr-xr-x 1 root root 6461 2015-05-10 06:25 apache2.2
-rwxr-xr-x 1 root root 6461 2015-05-17 06:25 apache2.1
-rwxr-xr-x 1 root root 0 2015-05-24 06:25 apache2
I am not sure if it is an apache update bug or some scheduled job. Here is my log rotation file:
/var/log/apache2/*.log {
weekly
missingok
rotate 52
compress
delaycompress
notifempty
create 644 root adm
sharedscripts
postrotate
if [ -f "`. /etc/apache2/envvars ; echo ${APACHE_PID_FILE:-/var/run/apache2.pid}`" ]; then
/etc/init.d/apache2 reload > /dev/null
fi
endscript
}
My apache2 version: 2.2.12
Edit: logrotate.conf
# see "man logrotate" for details
# rotate log files weekly
weekly
# keep 4 weeks worth of backlogs
rotate 4
# create new (empty) log files after rotating old ones
create
# packages drop log rotation information into this directory
include /etc/logrotate.d
# no packages own wtmp, or btmp -- we'll rotate them here
/var/log/wtmp {
missingok
monthly
create 0664 root utmp
rotate 1
}
/var/log/btmp {
missingok
monthly
create 0660 root utmp
rotate 1
}
You can check what logrotate do in /var/lib/logrotate.status file. Also check under /etc/cron.d/ directory if any job exist regarding rotate, or check /var/log/cron log. You might find useful to search the /etc directory for files containing apache2 daemon script:
I found a backup file in same path "
/etc/logrotate.d/apache2_backup
", which had the same content as "/etc/logrotate.d/apache2
", after I moved it to another location and kept only the original, my issue was fixed.Still i couldn't understand why 2 files with same content causes apache daemon file to log rotate!