On a VPS server running cPanel, I just ran into a disk consumption problem. One of the users’ error log files grew to nearly 800GB in less than 4 hours. As a result, the home partition became completely full, causing issues for all other cPanel accounts.
![error_log error_log](https://i0.wp.com/pcx3.com/wp-content/uploads/2022/04/image-106.png?resize=736%2C102&ssl=1)
By rotating the error log file when it reached 300MB in size, cPanel should have prevented this issue from ever occurring. But why didn’t it work?
Let’s first check the configuration: WHM > cPanel Log Rotation Configuration
![WHM > cPanel Log Rotation Configuration WHM > cPanel Log Rotation Configuration](https://i0.wp.com/pcx3.com/wp-content/uploads/2022/04/image-107.png?resize=593%2C711&ssl=1)
Because the error log file is already in rotation, let’s double-check that the size threshold isn’t too high: WHM > Tweak Settings > Stats and Logs
![WHM > Tweak Settings > Stats and Logs WHM > Tweak Settings > Stats and Logs](https://i0.wp.com/pcx3.com/wp-content/uploads/2022/04/image-108.png?resize=736%2C262&ssl=1)
So, because the settings are correct and the file should have rotated after it hit 300MB in size, we’ll look for clues in the logs.
grep logrotate /var/log/messages
![logrotate: ALERT exited abnormally with [1] - error_log file in cPanel not rotated image 109 - logrotate: ALERT exited abnormally with [1] - error_log file in cPanel not rotated](https://i0.wp.com/pcx3.com/wp-content/uploads/2022/04/image-109.png?resize=486%2C32&ssl=1)
The message logrotate: ALERT exited abnormally with [1]
comes from the /etc/cron.daily/logrotate
script:
![logrotate: ALERT exited abnormally with [1] - error_log file in cPanel not rotated image 110 - logrotate: ALERT exited abnormally with [1] - error_log file in cPanel not rotated](https://i0.wp.com/pcx3.com/wp-content/uploads/2022/04/image-110.png?resize=632%2C162&ssl=1)
So logrotate failed to rotate the file, after some googling the cause of the issue is SELinux:
SELinux denies logrotate to check the attributes of the rotated log file, this happens when logrotate has to rotate files outside of
RedHat KB – April 3 2014/var/log
(defined inlogrotate.conf
).
So, in my situation, the solution is to add attributes to user files in the public_html folder:
semanage fcontext -a -t var_log_t '/home/*/public_html(/.*)?'