[SOLVED] Tracking center time problem

[Palermo]

Dear experts! I would like to ask about a problem that the time of our "tracking center" points to the future.
The attached picture shows that there is also an entry for today's evening, even though it is now morning...
The server is virtual, esxi, the latest proxmox version, with today's update.
The time is also good on esxi host, proxmox, syslog. Not good only in the tracking center.
(we are in Hungary)
It doesn't affect the operation, but can something be done about it?

Thanks for the advice in advance.

 

[dcsapak]

what the timezone configured on the pmg and on your local client?

can you also post part of the logs of such a mail? (anonymized ofc)

 

[Palermo]

what the timezone configured on the pmg and on your local client?

can you also post part of the logs of such a mail? (anonymized ofc)

Time Zone: Budapest / Hungary

is that what you mean? (in tracking center)

Apr 6 23:59:56 smtp postfix/postscreen[1110978]: NOQUEUE: reject: RCPT from [183.13.191.110]:1698: 550 5.7.1 Service unavailable; client [183.13.191.110] blocked using bl.spamcop.net; from=<euduth@tiseng.com>, to=<xxx@domain.hu>, proto=ESMTP, helo=<in.hes.trendmicro.eu>

 

[dcsapak]

mhmm you long is your logrotate set ? is it possible that there is more than one year in your mail.log?
if yes, then thats the data from last year, as the log format (sadly) has no year built in and we "guess" that it's from the current one

 

[Palermo]

mhmm you long is your logrotate set ? is it possible that there is more than one year in your mail.log?
if yes, then thats the data from last year, as the log format (sadly) has no year built in and we "guess" that it's from the current one

as I can see there are 3 syslog files on the server. the earliest date is February 2022.
Is there a way to delete them and start logging in again?

 

[dcsapak]

what is the content of '/etc/logrotate.d/rsyslog' ?
instead of deleting and beginning anew, i'd recommend fixing the logrotate

 

[Palermo]

what is the content of '/etc/logrotate.d/rsyslog' ?
instead of deleting and beginning anew, i'd recommend fixing the logrotate

 

[dcsapak]

ok that looks ok so far, what does 'systemctl list-timers' show ?

 

[dcsapak]

also, is that pmg in a container? if yes, see this thread for the solution: https://forum.proxmox.com/threads/tracking-center-shows-logs-from-a-year-ago.120452/

 

[Palermo]

also, is that pmg in a container? if yes, see this thread for the solution: https://forum.proxmox.com/threads/tracking-center-shows-logs-from-a-year-ago.120452/

ok that looks ok so far, what does 'systemctl list-timers' show ?

root@smtp:~# systemctl list-timers
NEXT LEFT LAST PASSED UNIT ACTIVATES
Thu 2023-04-06 11:00:00 CEST 13min left Thu 2023-04-06 10:00:07 CEST 46min ago pmg-hourly.timer pmg-hourly.service
Thu 2023-04-06 15:53:41 CEST 5h 7min left Wed 2023-04-05 19:54:16 CEST 14h ago apt-daily.timer apt-daily.service
Fri 2023-04-07 00:00:00 CEST 13h left Thu 2023-04-06 00:00:25 CEST 10h ago logrotate.timer logrotate.service
Fri 2023-04-07 00:00:00 CEST 13h left Thu 2023-04-06 00:00:25 CEST 10h ago man-db.timer man-db.service
Fri 2023-04-07 00:01:00 CEST 13h left Thu 2023-04-06 00:01:17 CEST 10h ago pmgreport.timer pmgreport.service
Fri 2023-04-07 00:05:00 CEST 13h left Thu 2023-04-06 00:05:20 CEST 10h ago pmgspamreport.timer pmgspamreport.service
Fri 2023-04-07 02:29:42 CEST 15h left Thu 2023-04-06 01:44:36 CEST 9h ago pmg-daily.timer pmg-daily.service
Fri 2023-04-07 06:02:36 CEST 19h left Thu 2023-04-06 06:02:36 CEST 4h 43min ago systemd-tmpfiles-clean.timer systemd-tmpfiles-clean.service
Fri 2023-04-07 06:27:37 CEST 19h left Thu 2023-04-06 06:36:17 CEST 4h 9min ago apt-daily-upgrade.timer apt-daily-upgrade.service
Sun 2023-04-09 03:10:52 CEST 2 days left Sun 2023-04-02 03:10:36 CEST 4 days ago e2scrub_all.timer e2scrub_all.service
Mon 2023-04-10 00:59:37 CEST 3 days left Mon 2023-04-03 01:24:27 CEST 3 days ago fstrim.timer fstrim.service

11 timers listed.
Pass --all to see loaded but inactive timers, too.

 

[Palermo]

also, is that pmg in a container? if yes, see this thread for the solution: https://forum.proxmox.com/threads/tracking-center-shows-logs-from-a-year-ago.120452/

no, it's not in a container

 

[dcsapak]

mhmm ok thats weird

what does

systemctl status logrotate.sevice logrotate.timer

say?

 

[Palermo]

mhmm ok thats weird

what does

systemctl status logrotate.sevice logrotate.timer

say?

root@smtp:~# systemctl status logrotate.service logrotate.timer
● logrotate.service - Rotate log files
Loaded: loaded (/lib/systemd/system/logrotate.service; static)
Active: inactive (dead)
TriggeredBy: ● logrotate.timer
Docs: man:logrotate(8)
man:logrotate.conf(5)

● logrotate.timer - Daily rotation of log files
Loaded: loaded (/lib/systemd/system/logrotate.timer; enabled; vendor preset: enabled)
Active: active (waiting) since Thu 2023-04-06 05:47:59 CEST; 11h ago
Trigger: Fri 2023-04-07 00:00:00 CEST; 6h left
Triggers: ● logrotate.service
Docs: man:logrotate(8)
man:logrotate.conf(5)

Apr 06 05:47:59 smtp.xx.hu systemd[1]: Started Daily rotation of log files.

 

[dcsapak]

ok looks also normal AFAICS,

just to verify a few things, can you post the ouput of the following commands:

ls -lh /var/log/syslog*

and print the first few (e.g. 2) lines of each syslog file, e.g. with

head -n2 /var/log/syslog
head -n2 /var/log/syslog.1
zcat /var/log/syslog.2.gz | head -n2
...

i just want to verify if that the logrotate is really the issue here...

 

[Palermo]

ok looks also normal AFAICS,

just to verify a few things, can you post the ouput of the following commands:

ls -lh /var/log/syslog*

and print the first few (e.g. 2) lines of each syslog file, e.g. with

head -n2 /var/log/syslog
head -n2 /var/log/syslog.1
zcat /var/log/syslog.2.gz | head -n2
...

i just want to verify if that the logrotate is really the issue here...

I checked the rights yesterday and this is what I got. Couldn't the problem be that rsyslog is not owned by root? If I started the rotation from the command line, it indicated an error. I changed the owner of rsyslog to root and it started. As I saw, new log files were created in var/log. Although since the old logs are still there, the tracking center is still not good.

-rw-r--r-- 1 root root 120 Jan 30  2021 alternatives
-rw-r--r-- 1 root root 173 Jun 10  2021 apt
-rw-r--r-- 1 root root 130 Oct 14  2019 btmp
-rw-r--r-- 1 root root 160 May 13  2021 chrony
-rw-r--r-- 1 root root 382 Jan 29  2022 clamav-daemon
-rw-r--r-- 1 root root 409 Jan 29  2022 clamav-freshclam
-rw-r--r-- 1 root root 112 Jan 30  2021 dpkg
-rw-r--r-- 1 root root 268 Jan 25  2021 monit
-rw-r--r-- 1 root root 227 Apr 24  2020 pmg-api
-rw-r--r-- 1 root root 173 Nov 15  2019 postgresql-common
-rw-r--r-- 1 root root  88 Nov  9  2020 razor
-rw-r--r-- 1 1000 1000 501 Feb  3  2021 rsyslog
-rw-r--r-- 1 root root 145 Oct 14  2019 wtmp

 

[dcsapak]

I checked the rights yesterday and this is what I got. Couldn't the problem be that rsyslog is not owned by root? If I started the rotation from the command line, it indicated an error. I changed the owner of rsyslog to root and it started. As I saw, new log files were created in var/log. Although since the old logs are still there, the tracking center is still not good.

maybe but to verify, could you please post the output of the commands i wrote?

 

[Palermo]

maybe but to verify, could you please post the output of the commands i wrote?

root@smtp:~# ls -lh /var/log/syslog*
-rw-r----- 1 root adm 854K Apr  7 08:52 /var/log/syslog
-rw-r----- 1 root adm 750K Apr  7 00:01 /var/log/syslog.1
-rw-r--r-- 1 root adm 138M Apr  6 20:37 /var/log/syslog.2.gz
-rw-r--r-- 1 root adm  32K Feb  1  2022 /var/log/syslog.3.gz
-rw-r----- 1 root adm 830K Feb  1  2022 /var/log/syslog.4.gz

root@smtp:~# head -n2 /var/log/syslog
Apr  7 00:01:09 smtp systemd[1]: rsyslog.service: Sent signal SIGHUP to main process 606 (rsyslogd) on client request.
Apr  7 00:01:23 smtp pmg-smtp-filter[1007]: starting database maintenance

Feb  1 08:59:21 smtp systemd[1]: rsyslog.service: Sent signal SIGHUP to main process 640 (rsyslogd) on client request.
Feb  1 08:59:32 smtp pmg-smtp-filter[1009]: Killing "2" children

 

[Palermo]

Dear dcsapak, it looks like that was the problem. Although I don't know how rsyslog became another owner. The tracking center is now working properly. I will keep an eye on it...thank you very much for addressing the problem!!