Should logrotate timer be enabled by default on all installations?

[Kamil Dudka]

logrotate is a utility designed to simplify the administration of log files on 
a system which generates a lot of log files.  It used to be triggered by cron.  
The cron hook was unconditionally installed with logrotate but it took effect 
only if a cron daemon was installed.

Starting with Fedora 30, logrotate is triggered by a systemd timer instead.  
In order to make updates smoother, the timer was enabled on updates in case
a cron daemon was configured on the system.

The timer is currently not enabled on fresh installs to avoid surprises (such 
as data lost) on systems where logrotate is installed but not actually used.  
logrotate can also be triggered independently of systemd/cron and can be even 
run by non-privileged users to rotate logs they have access to.

Some people think that the logrotate timer should be enabled by default on all 
systems where the logrotate package is installed:

    https://bugzilla.redhat.com/1655153#c4

Do you think it would be a good idea?

Kamil

[Dusty Mabe]

On 3/18/20 8:04 AM, Kamil Dudka wrote:
>  logrotate is a utility designed to simplify the administration of log
> files on 
>  a system which generates a lot of log files.  It used to be triggered by cron.  
>  The cron hook was unconditionally installed with logrotate but it took effect 
>  only if a cron daemon was installed.
>  
>  Starting with Fedora 30, logrotate is triggered by a systemd timer instead.  
>  In order to make updates smoother, the timer was enabled on updates in case
>  a cron daemon was configured on the system.
>  
>  The timer is currently not enabled on fresh installs to avoid surprises (such 
>  as data lost) on systems where logrotate is installed but not actually used.  
>  logrotate can also be triggered independently of systemd/cron and can be even 
>  run by non-privileged users to rotate logs they have access to.
>  
>  Some people think that the logrotate timer should be enabled by default on all 
>  systems where the logrotate package is installed:
>  
>      https://bugzilla.redhat.com/1655153#c4
>  
>  Do you think it would be a good idea? 
I chimed in in the ticket too, but +1 from me.

I guess it would be worth analyzing the problem space a bit:

- in the past how many people do we think had logrotate installed and not cron?
- what are the worst case scenarios if logrotate.timer defaults to off?
- what are the worst case scenarios if logrotate.time defaults to on?

Dusty

[Kamil Dudka]

On Wednesday, March 18, 2020 3:20:17 PM CET Dusty Mabe wrote:
>  I guess it would be worth analyzing the problem space a bit:
>  
>  - in the past how many people do we think had logrotate installed and not cron? 
I am worried more about automated provisioning rather than manual installations.

>  - what are the worst case scenarios if logrotate.timer defaults to
> off? 
- Running out of disk space.

- Violation of privacy and retention terms.

>  - what are the worst case scenarios if logrotate.time defaults to on?
- Unexpected data loss.

- Security holes triggered by (previously ineffective) insecure logrotate
  configurations as, for example, this one:

    https://bugzilla.redhat.com/CVE-2019-10143

Kamil

[Zbigniew Jędrzejewski-Szmek]

On Wed, Mar 18, 2020 at 01:04:58PM +0100, Kamil Dudka wrote:
>  logrotate is a utility designed to simplify the administration of log
> files on 
>  a system which generates a lot of log files.  It used to be triggered by cron.  
>  The cron hook was unconditionally installed with logrotate but it took effect 
>  only if a cron daemon was installed.
>  
>  Starting with Fedora 30, logrotate is triggered by a systemd timer instead.  
>  In order to make updates smoother, the timer was enabled on updates in case
>  a cron daemon was configured on the system.
>  
>  The timer is currently not enabled on fresh installs to avoid surprises (such 
>  as data lost) on systems where logrotate is installed but not actually used.  
>  logrotate can also be triggered independently of systemd/cron and can be even 
>  run by non-privileged users to rotate logs they have access to.
>  
>  Some people think that the logrotate timer should be enabled by default on all 
>  systems where the logrotate package is installed:
>  
>      https://bugzilla.redhat.com/1655153#c4
>  
>  Do you think it would be a good idea? 
Yes, I think it's reasonable to enable it by default. People should just not
install logrotate package if it's not necessary. We should also make sure that
the package is not Required from those packages that use the journal.

(I think that for most cases text logs are not necessary, and journald
is a better approach, but for the cases where text logs are created,
logrotate is something that people want 99% of the time, so we should
make it easy to have the right thing happen if the package is installed.)

Note: we have a documented process for enabling services:
https://docs.fedoraproject.org/en-US/packaging-guidelines/DefaultServices/.
logrotate.timer satisfies the requirements to be enabled without a fesco
exception. So it should be enough to file a PR for fedora-release.

Zbyszek

[Kamil Dudka]

On Wednesday, March 18, 2020 3:50:34 PM CET Zbigniew Jędrzejewski-Szmek wrote:
>  On Wed, Mar 18, 2020 at 01:04:58PM +0100, Kamil Dudka wrote:
>  
>  > logrotate is a utility designed to simplify the administration of log
>  > files on  
 a system which generates a lot of log files.  It used to be
>  > triggered by cron. The cron hook was unconditionally installed
> with
>  > logrotate but it took effect only if a cron daemon was installed.
>  > 
>  > Starting with Fedora 30, logrotate is triggered by a systemd timer
>  > instead.   
 In order to make updates smoother, the timer was enabled on
>  > updates in case a cron daemon was configured on the system.
>  > 
>  > The timer is currently not enabled on fresh installs to avoid surprises
>  > (such  
 as data lost) on systems where logrotate is installed but not
>  > actually used. logrotate can also be triggered independently of
>  > systemd/cron and can be even run by non-privileged users to rotate logs
>  > they have access to.
>  > 
>  > Some people think that the logrotate timer should be enabled by default on
>  > all  
 systems where the logrotate package is installed:
>  > 
>  > 
>  >     https://bugzilla.redhat.com/1655153#c4
>  > 
>  > 
>  > Do you think it would be a good idea?
>  
>  
>  Yes, I think it's reasonable to enable it by default. People should just
>  not 
 install logrotate package if it's not necessary. We should also make
>  sure that the package is not Required from those packages that use
> the
>  journal. 
>  (I think that for most cases text logs are not necessary, and journald
>  is a better approach, but for the cases where text logs are created,
>  logrotate is something that people want 99% of the time, so we should
>  make it easy to have the right thing happen if the package is installed.)
>  
>  Note: we have a documented process for enabling services:
>  https://docs.fedoraproject.org/en-US/packaging-guidelines/DefaultServices/.
>  logrotate.timer satisfies the requirements to be enabled without a fesco
>  exception. So it should be enough to file a PR for fedora-release. 
>  Zbyszek 
Thank you all for sharing your opinion on this!

I have opened a pull request to enable logrotate.timer by default:

    https://src.fedoraproject.org/rpms/fedora-release/pull-request/111

Kamil

[Björn Persson]

Kamil Dudka wrote:
>  The timer is currently not enabled on fresh installs to avoid
> surprises (such 
>  as data lost) 
That's a surprise only if somebody expected that logs would be retained
forever. Do people expect that?

Random programs failing because the disk is full is a worse surprise in
my opinion. I think logs should be rotated by default to avoid such
surprises.

Björn Persson

[Robbie Harwood]

Björn Persson <Bjorn(a)xn--rombobjrn-67a.se&gt; writes:

>  Kamil Dudka wrote:
>
> > The timer is currently not enabled on fresh installs to avoid
> > surprises (such as data lost)
>
>  That's a surprise only if somebody expected that logs would be retained
>  forever. Do people expect that? 
Yes.

>  Random programs failing because the disk is full is a worse surprise
>  in my opinion. I think logs should be rotated by default to avoid such
>  surprises. 
Log rotation here encompasses different things.  I totally agree that
logs should be rotated - by which I mean, periodically moved to a
separate file and compressed.

Thanks,
--Robbie