/etc/cron.daily/logrotate: gzip: stdin: file size changed while zipping

Symptoms

You have received an email from your server with a reference to the following:

/etc/cron.daily/logrotate:

error: Compressing program wrote following message to stderr when compressing log /usr/local/apache/logs/modsec_audit.log-20221211:
gzip: stdin: file size changed while zipping

Description

This error occurs when the logrotate service runs with the incorrect compression configuration, and the log files are written to while they are being archived. This will only affect custom log rotation configurations that are done by logrotated.

Workaround

If the error does not highlight which configuration or log file is causing the issue, you will need to add the "--verbose" flag to the logrotated cron in the following crontab file:

/etc/cron.daily/logrotate

To resolve the error, ensure that the appropriate flags are added to the logrotated configuration:

1. Access your server via SSH as the root user.
2. Using your preferred text editor, edit the appropriate configuration in the "/etc/logrotate.d/" directory. Ensure that the configuration includes "compress" and "delaycompress" in order as shown in this example from dpkg:

   /var/log/dpkg.log {
   monthly
   rotate 12
   compress
   delaycompress
   missingok
   notifempty
   create 644 root root
   }

3. Save the file, and the configuration will be used the next time logrotated runs against that log file.