Logrotate Alert

After upgrading to centOS 6.6 to 6.7 I started getting this alert from Anacron:

/etc/cron.daily/logrotate:
logrotate_script: line 1: /usr/local/bin/mysql: No such file or directory error: error running shared postrotate script for '/var/log/newrelic/php_agent.log ’

here’s logrotate.conf:

# see “man logrotate” for details

rotate log files weekly

weekly

keep 4 weeks worth of backlogs

rotate 4

create new (empty) log files after rotating old ones

create

use date as a suffix of the rotated file

dateext

uncomment this if you want your log files compressed

#compress

RPM packages drop log rotation information into this directory

include /etc/logrotate.d

no packages own wtmp and btmp – we’ll rotate them here

/var/log/wtmp {
monthly
create 0664 root utmp
minsize 1M
rotate 1
}

/var/log/btmp {
missingok
monthly
create 0600 root utmp
rotate 1
}

system-specific logs may be also be configured here.

Howdy,

It looks like you’re seeing an issue specific to the newrelic MySQL version there, which doesn’t come with CentOS.

Somewhere in your logrotate config, there is a postrotate script for the “/var/log/newrelic/php_agent.log”.

That postrotate script is pointing to a MySQL location that doesn’t exist.

You’d need to update the config in logrotate being used for that, or the shell script if it’s calling out to a script – and point it to your correct MySQL location. I unfortunately don’t know where that is though, I’m not sure where newrelic stores that.

-Eric

Newrelic doesn’t use or require MySQL at all… is there another possibility?

Thx

Howdy,

Well, all I know is that the error is related to the “/var/log/newrelic/php_agent.log” log.

That’s something related to newrelic.

I don’t know what it’s doing, but I do know it’s generating this error:

line 1: /usr/local/bin/mysql: No such file or directory

I unfortunately don’t know more than that…

The next step is to find the log rotation for the “/var/log/newrelic/php_agent.log” log, and review that to figure out what it’s trying to do.

Can you post the logrotate config for that log?

-Eric

/var/log/newrelic/php_agent.log { rotate 7 daily missingok notifempty sharedscripts copytruncate compress }

Howdy,

Well, I have good news and bad news :slight_smile:

The good news is that I’m not seeing anything related to php_agent.log causing the problem.

But the bad news is that I also don’t see what the issue is :slight_smile:

I suspect the issue is just that the log for php_agent.log is just the last one being processed before the “sharedscripts” are being run.

What is the output of these two commands:

grep mysql /etc/logrotate.d/*

If that doesn’t show anything, can you paste in the contents of all the config files located in /etc/logrotate.d/?

-Eric

/etc/logrotate.d/mysqld:/var/log/mysqld.log {
/etc/logrotate.d/mysqld: create 640 mysql mysql
/etc/logrotate.d/mysqld: # just if mysqld is really running
/etc/logrotate.d/mysqld: if test -x /usr/bin/mysqladmin &&
/etc/logrotate.d/mysqld: /usr/bin/mysqladmin ping &>/dev/null
/etc/logrotate.d/mysqld: /usr/bin/mysqladmin flush-logs
/etc/logrotate.d/mysqld-slow:/var/run/mysqld/mysqld-slow.log {
/etc/logrotate.d/mysqld-slow: create 660 mysql mysql
/etc/logrotate.d/mysqld-slow: /usr/bin/mysql -e ‘select @@global.long_query_time into @lqt_save; set global long_query_time=2000; select sleep(2); FLUSH LOGS; select sleep(2); set global long_query_time=@lqt_save;’
/etc/logrotate.d/mysqld-slow:create 660 mysql mysql
/etc/logrotate.d/mysqld-slow:/usr/local/bin/mysql -e ‘select @@global.long_query_time into @lqt_save; set global long_query_time=2000; select sleep(2); FLUSH LOGS; select sleep(2); set global long_query_time=@lqt_save;’

Ah, what is the output of this command:

rpm -qf /etc/logrotate.d/mysqld-slow

Also, while you’re getting the output of that command above, you may want to edit “/etc/logrotate.d/mysqld-slow”, and make sure any references to “/usr/local/bin/mysql” in there instead point to “/usr/bin/mysql”.

-Eric

rpm -qf /etc/logrotate.d/mysqld-slow file /etc/logrotate.d/mysqld-slow is not owned by any package

changed 1 line in “/etc/logrotate.d/mysqld-slow” from “/usr/local/bin/mysql” to “/usr/bin/mysql”

thanks

I am now getting

/etc/cron.daily/logrotate:
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: NO) error: error running shared postrotate script for '/var/log/newrelic/php_agent.log ’

Do you know where that config for the MySQL slow log came from? I’m wondering if that’s causing your problem.

To my knowledge that isn’t included by default.

You may want to try removing that (even if it’s just temporarily) to see if that resolves your issue.

-Eric

we keep log mysql-slow queries and the the mysqlp-slow log rotation is working fine.

the issue is now permissions, but there shouldnt be a problem:
http://i.imgur.com/iKITIww.png

Howdy,

What permissions problem are you seeing?

-Eric

http://virtualmin.com/node/37759#comment-152671

Sorry I’m not sure that link is working properly… Are you referring to the mysql access denied message above?

If so, that’s an issue with the log rotation script trying to access mysql without a password.

It seems like there is a problem with the way that rotation script is created, it may not work properly as-is. I was wondering if removing it, even temporary, resolved the issue.

If so, at least you know the culprit.

  • Eric

I

i got the link from the top right chain link icon from the “Posted: Fri, 2015-08-14 01:31” post, which reads:

I am now getting

/etc/cron.daily/logrotate:
ERROR 1045 (28000): Access denied for user ‘root’@'localhost’ (using password: NO) error: error running shared postrotate script for '/var/log/newrelic/php_agent.log ’

Yeah that’s the error I suspected… my recommendation is the advice I gave in my previous comment above then. That would be a good next step.

If that helps, then we’ll know which script is causing the issue.

-Eric

Sorry, that last error msg (the one posted twice and linked to once) doesn’t even mention mysql.

and i posted the permissions for the newrelic log.

confused.

New one today, for a weekly rotation

ERROR 1045 (28000): Access denied for user ‘root'@'localhost’ (using password: NO) error: error running shared postrotate script for ‘/var/log/newrelic/php_agent.log ' ERROR 1045 (28000): Access denied for user 'root'@'localhost’ (using password: NO) error: error running shared postrotate script for '/var/log/rkhunter/rkhunter.log '

Files are root:root with 640.