/usr/sbin/logrotate does not rotate the log files in /var/log

This document (7022373) is provided subject to the disclaimer at the end of this document.

Environment

SUSE Linux Enterprise Server 11 Service Pack 4 (SLES 11 SP4)

Situation

The log files in /var/log/ are not rotated.

Resolution

Please check if a different application is modifying the files in /var/spool/cron/lastrun.
You can easily check it with the following command.:

# stat /var/spool/cron/lastrun/cron.daily 
  File: `/var/spool/cron/lastrun/cron.daily'
  Size: 0               Blocks: 0          IO Block: 4096   regular empty file
Device: ca02h/51714d    Inode: 713141      Links: 1
Access: (0644/-rw-r--r--)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2017-11-22 15:30:01.000000000 +0100
Modify: 2017-11-22 15:30:01.000000000 +0100
Change: 2017-11-22 15:30:01.000000000 +0100
 Birth: -

Access time, modify time and change time of the files should be equal as the files will be removed and newly created when cron.daily had been run. If they are not, something has changed the time on purpose (maybe some backup software)

Cause

/usr/sbin/logrotate will be run by crond on a daily basis.
To do so crond is executing /usr/lib/cron/run-crons every 15 minutes which in turn is checking the change time (ctime) of the files in /var/spool/cron/lastrun/

If another application is modifying the change time of /var/spool/cron/lastrun/cron.daily, /usr/lib/cron/run-crons will never run any directive file in /etc/cron.daily/ where the logrotate file is stored as well.

Additional Information

Disclaimer

This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.