logrotate: ALERT exited abnormally with [1] – error_log file in cPanel not rotated

On a VPS server running cPanel, I just ran into a disk consumption problem. One of the users’ error log files grew to nearly 800GB in less than 4 hours. As a result, the home partition became completely full, causing issues for all other cPanel accounts.

By rotating the error log file when it reached 300MB in size, cPanel should have prevented this issue from ever occurring. But why didn’t it work?

Let’s first check the configuration: WHM > cPanel Log Rotation Configuration

Because the error log file is already in rotation, let’s double-check that the size threshold isn’t too high: WHM > Tweak Settings > Stats and Logs

So, because the settings are correct and the file should have rotated after it hit 300MB in size, we’ll look for clues in the logs.

grep logrotate /var/log/messages

The message logrotate: ALERT exited abnormally with [1] comes from the /etc/cron.daily/logrotate script:

So logrotate failed to rotate the file, after some googling the cause of the issue is SELinux:

SELinux denies logrotate to check the attributes of the rotated log file, this happens when logrotate has to rotate files outside of /var/log (defined in logrotate.conf).

RedHat KB – April 3 2014

So, in my situation, the solution is to add attributes to user files in the public_html folder:

semanage fcontext -a -t var_log_t '/home/*/public_html(/.*)?'