Having trouble with ‘Logrotate duplicate log entry‘?

Logrotate utility makes server log management easy.

However, the misconfiguration of logrotate often ends up in errors.

At Bobcares, we often get requests from customers to fix duplicate log entries as part of our Server Management Services.

Today, let’s get into the details on how our Support Engineers help customers to fix logrotate errors.

Reson behind ‘Logrotate duplicate log entry’

Logrotate is an important tool to manage log files for system security.

It is for regularly rotating log files by removing the old ones from the system and creating new log files.

Logrotate helps to compress log files and to send emails to users after completing log rotation. This logrotate option allows avoiding the overgrowing of log files. In a way, it keeps server disk space usage less too.

The default configuration file location of Logrotate is at:

/etc/logrotate.conf

Note that one line in this file reads as :

include /etc/logrotate.d

That directory contains most of the application-specific configuration files.

However, the duplicate log entry problem occurs in Logrotate. This happens mainly due to more number of duplicate entries in the /etc/logrotate.d directory.

Let’s detail how our Support Engineers fix this problem.

Logrotate duplicate log entry: How we corrected!

At Bobcares, where we have more than a decade of expertise in managing servers, we see many customers face this problem.

Now, let’s see how our Support Engineers fixed a similar error by removing duplicate log entries.

Recently one of the customers approached us saying that he was getting error notifications every time Logrotate runs. He was getting the following error notification in his email.

SUBJECT:
Anacron job 'cron.daily' on xxxx
BODY:
/etc/cron.daily/logrotate:
error: modsecurity_logs:1 duplicate log entry for /usr/local/apache/logs/modsec_audit.log

On further analysis, we traced that a duplicate entry for “/usr/local/apache/logs/modsec_audit.log” was present on the server. This was the root cause of this error message.

We then disabled the duplicate entry “/etc/logrotate.d/modsecurity_logs” on the server.

We also confirmed that log rotate is correctly set in the script “/usr/local/cpanel/etc/logrotate.d/modsecurity_logs“.

[Still, having trouble with Logrotate? – Our Experts are available 24/7.]

Conclusion

In short, Logrotate duplicate log entry error happens due to incorrect entries in the config directory. Today, we saw how our Support Engineers helped our customer to resolve this problem by disabling the duplicate entry.