Skip to main content

error logrotate

PatrickVeenstra

Since about a week ago, I'm receiving every day an email "Anacron job 'cron.daily' on *my server*" with this error:

/etc/cron.daily/logrotate:

error: Compressing program wrote following message to stderr when compressing log /var/log/cpanel-server-traffic/web/2025-05-01-traffic-apache.log:
gzip: stdin: file size changed while zipping

It's quite annoying to receive a warning every day, but more important: will this affect in the long term in anything? e.g. a too big log file.

Comments

17 comments

Date Votes
  • mtindor

    I'm betting that has to do specifically with the new file added by ea-cpanel-tools

    /var/log/cpanel-server-traffic/web/traffic-apache.log and associated files in that directory.

    even with me seeing those errors occasionally, it's not affecting the log rotate.  The logs are being compressed and rotated daily (at least on my servers)

    But that traffic-apache.log is constantly growing at a pretty high rate, and it makes sense that during the comrpessing of the log for archiving, something would be being written to it and cause that error message from time to time.

     

    0
  • Richard Brandson

    Same error started occurring recently on one WHM server here. Solution would be nice.

    0
  • GBTim
    • Edited

    We are seeing the same starting on May 1st.  It happened randomly about a half dozen times in all of 2025, but has happened every night since May1st for the majority of our servers.

    0
  • chris matthews

    Same for about two weeks, yet to solve.

    0
  • mtindor

    Just to understand why this happens:

    1.  On a busy server, this log is constantly written to (way more than any individual apache log or apache domainlog.

    2.  Compression starts on the file, but before compression can be finished (because the file is likely huge) more data is being written to the source file being compressed while compression is occurring.

    3.  By default this file is rotated daily.  On busy servers it probably needs to be rotated more often, so that it is not as large and has a better likelihood of being compressed completely before more data is written to it.

    4.  For very active servers some possible (crappy) options would be:

    a.  rotate the log more often (see below)

    b   don't compress the log (as large as these files get, they need to be compressed)

    Of course, ultimately we should just wait for cPanel or CL or whomever is responsible to modify things so this doesn't happen.   The error isn't indicating that its hurting anything.  You might be missing some entries in the compressed log, but big deal.   Us admins likely aren't going to ever be looking at that particular log because we'd prefer to be finding info from /usr/local/apache/logs and /usr/local/apache/domlogs.   I'm not sure what this log file is suddenly being generated for, but it's not for the benefit of us admins.  Must be for the benefit of some monitoring/statistics keeping stuff that is new.

    When I see this particular error in my email, I just ignore it.  No reason to sweat over it.

    Here's the default config in /etc/logrotate.d/apache

    /var/log/cpanel-server-traffic/web/traffic-apache.log {
        rotate 5
        daily
        compress
        missingok
        extension traffic-apache.log
        dateext
        dateformat %Y-%m-%d-
        dateyesterday

    "daily is the rotation interval"

     

    If a rotation interval is not specified the log will be rotated whenever
    logrotate runs (unless another condition like size has been set).

    If you want to use a time interval other than the defined ones, you need
    to use cron to create a separate configuration file. For example, if you want
    to rotate a particular log file hourly, you could create a file in
    /etc/cron.hourly (you might need to create that directory too) that would
    contain a line like the following:

     
    /usr/sbin/logrotate /etc/logrotate.hourly.conf

    Then you would put the configuration for that hourly run of logrotate (the log
    file location, whether or not to compress old files, and so on) into
    /etc/logrotate.hourly.conf.

     

    0
  • cPRex Jurassic Moderator

    Exactly what mtindor said - this isn't really a software issue, but more of a timing issue, and there wouldn't be a way to fix this for all situations by default.

    We've been recommending the following adjustment to the logrotate configuration, and most have reported good results when using it:

    /var/log/cpanel-server-traffic/web/traffic-apache.log {
        rotate 5
        daily
        compress
        delaycompress
        missingok
        extension traffic-apache.log
        dateext
        dateformat %Y-%m-%d-
        dateyesterday
    }
    2
  • chris matthews

    Thanks.

    0
  • cPRex Jurassic Moderator

    You're very welcome!

    0
  • PatrickVeenstra

    It seems that fixed it. Great!

    1
  • Richard Brandson

    @cPRex nice that making custom changes can "fix the problem" but the purpose of making these posts are because we are waiting for WHM/cPanel, who we pay a license to, to fix it, not a temp fix from a random dude in a chat. Thanks.

    WTF are cPanel doing about this?

    0
  • cPRex Jurassic Moderator
    • Edited

    Richard Brandson - I'm not sure there's anything we can do about this one - the log file just happens to be getting written to while the logrotate tool is running.  There isn't going to be a solution that is perfect for all users as that is just completely random.

    If you believe your situation warrants a deeper look, feel free to submit a ticket so your system can be examined.

    0
  • Richard Brandson

    Ah well.... Thank you for doing you best in providing a workaround then.

    0
  • cPRex Jurassic Moderator

    You're very welcome.

    0
  • Gaj Capuder
    • Edited

    Was there some change/fix applied recently as till today all logs were kept uncompressed in their full size without rotation or auto delete. From yestrday on I see the file was gzip-ed for the first time on multiple servers?

     

    0
  • cPRex Jurassic Moderator

    Gaj Capuder - I'm seeing that on my end as well on my personal machine.  I'm looking into this and I'll let you know what I find.

    0
  • cPRex Jurassic Moderator

    Gaj Capuder - we think this is an artifact related to last week's EasyApache update:

    https://support.cpanel.net/hc/en-us/community/posts/32106526719767-EasyApache4-v25-15-Maintenance-Release

    • ea-apache24-config
      • ZC-12824: Fix traffic logs when not piped logs on Apache
    • ea-nginx
      • ZC-12825: Correct traffic log issue when not using piped logs

    Our team has opened case ZC-12834 to look into this.  While it may actually be an improvement because of the resulting smaller file size on disk, it isn't documented so we want to make sure this setting is handled properly.

    I'll be sure to update this thread if I hear more details on this issue.

    0
  • Gaj Capuder
    • Edited

    cPRex it seems not to be the solution. Today the GZIP-ed file from yestrday was unpacked and is now in full size, there is new GZIP-ed file just for today. So it seems the log makes GZIP of last day end of the day but then next day it uncompresses it back? I belive this must be some kind of bug as it doesnt make much sense to me to work like this. Looks like the script is missing the auto delete of .log file.

    Here is the todays situation on same servers as I posted yestrday, you can see the "shift" in GZIP files.

     

    0

Please sign in to leave a comment.

Didn't find what you were looking for?

New post