Logrotate Alert

21 posts / 0 new
Last post
#1 Mon, 08/10/2015 - 13:18
eddieb

Logrotate Alert

After upgrading to centOS 6.6 to 6.7 I started getting this alert from Anacron:

/etc/cron.daily/logrotate:
logrotate_script: line 1: /usr/local/bin/mysql: No such file or directory error: error running shared postrotate script for '/var/log/newrelic/php_agent.log '

here's logrotate.conf:

# see "man logrotate" for details
# rotate log files weekly
weekly

# keep 4 weeks worth of backlogs
rotate 4

# create new (empty) log files after rotating old ones
create  

# use date as a suffix of the rotated file
dateext

# uncomment this if you want your log files compressed
#compress

# RPM packages drop log rotation information into this directory
include /etc/logrotate.d

# no packages own wtmp and btmp -- we'll rotate them here
/var/log/wtmp {
    monthly
    create 0664 root utmp
minsize 1M
    rotate 1
}

/var/log/btmp {
    missingok
    monthly
    create 0600 root utmp
    rotate 1
}

# system-specific logs may be also be configured here.
Mon, 08/10/2015 - 20:10
andreychek

Howdy,

It looks like you're seeing an issue specific to the newrelic MySQL version there, which doesn't come with CentOS.

Somewhere in your logrotate config, there is a postrotate script for the "/var/log/newrelic/php_agent.log".

That postrotate script is pointing to a MySQL location that doesn't exist.

You'd need to update the config in logrotate being used for that, or the shell script if it's calling out to a script -- and point it to your correct MySQL location. I unfortunately don't know where that is though, I'm not sure where newrelic stores that.

-Eric

Wed, 08/12/2015 - 15:53
eddieb

Newrelic doesn't use or require MySQL at all... is there another possibility?

Thx

Wed, 08/12/2015 - 16:13
andreychek

Howdy,

Well, all I know is that the error is related to the "/var/log/newrelic/php_agent.log" log.

That's something related to newrelic.

I don't know what it's doing, but I do know it's generating this error:

line 1: /usr/local/bin/mysql: No such file or directory

I unfortunately don't know more than that...

The next step is to find the log rotation for the "/var/log/newrelic/php_agent.log" log, and review that to figure out what it's trying to do.

Can you post the logrotate config for that log?

-Eric

Wed, 08/12/2015 - 19:42
eddieb
/var/log/newrelic/php_agent.log {
    rotate 7
    daily
    missingok
    notifempty
    sharedscripts
    copytruncate
    compress
}
Wed, 08/12/2015 - 22:35
andreychek

Howdy,

Well, I have good news and bad news :-)

The good news is that I'm not seeing anything related to php_agent.log causing the problem.

But the bad news is that I also don't see what the issue is :-)

I suspect the issue is just that the log for php_agent.log is just the last one being processed before the "sharedscripts" are being run.

What is the output of these two commands:

grep mysql /etc/logrotate.d/*

If that doesn't show anything, can you paste in the contents of all the config files located in /etc/logrotate.d/?

-Eric

Wed, 08/12/2015 - 22:48
eddieb
/etc/logrotate.d/mysqld:/var/log/mysqld.log {
/etc/logrotate.d/mysqld:        create 640 mysql mysql
/etc/logrotate.d/mysqld:        #        just if mysqld is really running
/etc/logrotate.d/mysqld:        if test -x /usr/bin/mysqladmin && \
/etc/logrotate.d/mysqld:        /usr/bin/mysqladmin ping &>/dev/null
/etc/logrotate.d/mysqld:        /usr/bin/mysqladmin flush-logs
/etc/logrotate.d/mysqld-slow:/var/run/mysqld/mysqld-slow.log {
/etc/logrotate.d/mysqld-slow:   create 660 mysql mysql
/etc/logrotate.d/mysqld-slow:   /usr/bin/mysql -e 'select @@global.long_query_time into @lqt_save; set global long_query_time=2000; select sleep(2); FLUSH LOGS; select sleep(2); set global long_query_time=@lqt_save;'
/etc/logrotate.d/mysqld-slow:create 660 mysql mysql
/etc/logrotate.d/mysqld-slow:/usr/local/bin/mysql -e 'select @@global.long_query_time into @lqt_save; set global long_query_time=2000; select sleep(2); FLUSH LOGS; select sleep(2); set global long_query_time=@lqt_save;'
Thu, 08/13/2015 - 09:29
andreychek

Ah, what is the output of this command:

rpm -qf /etc/logrotate.d/mysqld-slow

Thu, 08/13/2015 - 09:54
andreychek

Also, while you're getting the output of that command above, you may want to edit "/etc/logrotate.d/mysqld-slow", and make sure any references to "/usr/local/bin/mysql" in there instead point to "/usr/bin/mysql".

-Eric

Thu, 08/13/2015 - 12:29
eddieb
rpm -qf /etc/logrotate.d/mysqld-slow
file /etc/logrotate.d/mysqld-slow is not owned by any package

changed 1 line in "/etc/logrotate.d/mysqld-slow" from "/usr/local/bin/mysql" to "/usr/bin/mysql"

thanks

Thu, 08/13/2015 - 23:31
eddieb

I am now getting

/etc/cron.daily/logrotate:
ERROR 1045 (28000): Access denied for user ‘root'@'localhost’ (using password: NO) error: error running shared postrotate script for '/var/log/newrelic/php_agent.log '
Fri, 08/14/2015 - 00:54
andreychek

Do you know where that config for the MySQL slow log came from? I'm wondering if that's causing your problem.

To my knowledge that isn't included by default.

You may want to try removing that (even if it's just temporarily) to see if that resolves your issue.

-Eric

Fri, 08/14/2015 - 12:45
eddieb

we keep log mysql-slow queries and the the mysqlp-slow log rotation is working fine.

the issue is now permissions, but there shouldnt be a problem: http://i.imgur.com/iKITIww.png

Fri, 08/14/2015 - 13:33
andreychek

Howdy,

What permissions problem are you seeing?

-Eric

Fri, 08/14/2015 - 14:05
Fri, 08/14/2015 - 15:24
andreychek

Sorry I'm not sure that link is working properly... Are you referring to the mysql access denied message above?

If so, that's an issue with the log rotation script trying to access mysql without a password.

It seems like there is a problem with the way that rotation script is created, it may not work properly as-is. I was wondering if removing it, even temporary, resolved the issue.

If so, at least you know the culprit.

  • Eric

I

Fri, 08/14/2015 - 19:49
eddieb

i got the link from the top right chain link icon from the "Posted: Fri, 2015-08-14 01:31" post, which reads:

I am now getting

/etc/cron.daily/logrotate:
ERROR 1045 (28000): Access denied for user ‘root'@'localhost’ (using password: NO) error: error running shared postrotate script for '/var/log/newrelic/php_agent.log '
Fri, 08/14/2015 - 22:05
andreychek

Yeah that's the error I suspected... my recommendation is the advice I gave in my previous comment above then. That would be a good next step.

If that helps, then we'll know which script is causing the issue.

-Eric

Sat, 08/15/2015 - 08:02
eddieb

Sorry, that last error msg (the one posted twice and linked to once) doesn't even mention mysql.

and i posted the permissions for the newrelic log.

confused.

Sun, 08/16/2015 - 13:28
eddieb

New one today, for a weekly rotation

ERROR 1045 (28000): Access denied for user ‘root'@'localhost’ (using password: NO) error: error running shared postrotate script for ‘/var/log/newrelic/php_agent.log ' ERROR 1045 (28000): Access denied for user 'root'@'localhost’ (using password: NO) error: error running shared postrotate script for '/var/log/rkhunter/rkhunter.log '

Files are root:root with 640.

Mon, 08/17/2015 - 10:01
andreychek

I know it doesn't mention MySQL, but this is actually a MySQL error:

ERROR 1045 (28000): Access denied for user ‘root'@'localhost’

That is what MySQL produces when someone tries to login to MySQL, but it isn't successful.

You're welcome to Google it if you like, but that's definitely a MySQL access related problem :-)

-Eric

Topic locked