Troubleshooting
Problem
The /var/cache/logwatch/ keeps growing every day and contains very old files that are not deleted.
Symptom
/var/cache/logwatch/ keeps growing without cleanup
Cause
One of the possible causes is that the logwatch cron job is not working properly. Logwatch is executed daily and if for any reason it fails, it will leave the log file in the /var/cache/logwatch folder and doesn't clean it up automatically.
Environment
PDA hosts
Diagnosing The Problem
Check if logwatch runs, it should show the reason it is not working properly.
root@ha1 cron.daily]# logwatch
You have old files in your logwatch tmpdir (/var/cache/logwatch):
logwatch.FlaRcfWk
logwatch.5MxTas7s
logwatch.AaDmjEgP
logwatch.DnmEXkyj
...
many more files
...
logwatch.jKImHW7R
logwatch.IptyYnlY
logwatch.4B6Ng_dg
logwatch.weAJ1hzs
logwatch.8UWAZy6N
The directories listed above were most likely created by a
logwatch run that failed to complete successfully. If so, you
may delete these directories.
/etc/mail/submit.cf: line 552: fileclass: cannot open
'/etc/mail/trusted-users': No such file or directory
So the execution tells that those files are piling up in /var/cache/logwatch is because the logwatch script itself is not completing. If it were to complete successfully, its cache file would not be retained.
In this case logwatch is failing because the file /etc/mail/trusted-users is not found.
Resolving The Problem
In this case we are missing some files in /etc/mail/
To solve the problem compare the folder in ha1 and ha2 and copy the files that are missing.
This is the list of expected files. If you are missing files in both hosts contact IBM Support.
[root@ha1]$ ls -la /etc/mail/
total 208
drwxr-xr-x. 2 root root 4096 May 30 2013 .
drwxr-xr-x. 97 root root 12288 Aug 3 03:25 ..
-rw-r--r--. 1 root root 469 May 20 2009 access
-rw-r-----. 1 root root 12288 May 30 2013 access.db
-rw-r--r--. 1 root root 0 May 30 2013 aliasesdb-stamp
-rw-r--r--. 1 root root 233 Apr 12 2007 domaintable
-rw-r-----. 1 root root 12288 May 30 2013 domaintable.db
-rw-r--r--. 1 root root 5584 Jun 17 2010 helpfile
-rw-r--r--. 1 root root 64 Apr 12 2007 local-host-names
-rw-r--r--. 1 root root 997 Apr 12 2007 mailertable
-rw-r-----. 1 root root 12288 May 30 2013 mailertable.db
-rwxr-xr-x. 1 root root 2700 May 20 2009 make
-rw-r--r--. 1 root root 92 May 20 2009 Makefile
-rw-r--r--. 1 root root 58439 Jun 17 2010 sendmail.cf
-rw-r--r--. 1 root root 7202 May 20 2009 sendmail.mc
-rw-r--r--. 1 root root 41521 Jun 17 2010 submit.cf
-rw-r--r--. 1 root root 941 Jun 17 2010 submit.mc
-rw-r--r--. 1 root root 127 Apr 12 2007 trusted-users
-rw-r--r--. 1 root root 1847 Apr 12 2007 virtusertable
-rw-r-----. 1 root root 12288 May 30 2013 virtusertable.db
Once you have all the expected files in HA1 try again the logwatch command. It should run without any issue and also clean up the folder /var/cache/logwatch/.
If you put the files but logwatch is still failing please collect the output and contact IBM Support.
Was this topic helpful?
Document Information
Modified date:
17 October 2019
UID
swg22006926