cron.hourly is not working

Question

I have scheduled the cron.hourly job for rotating the catalina.out log. I have created a file called tomcat in logrotate.d with below content

/opt/apache-tomcat-7.0.55/logs/catalina.out {
    copytruncate
    daily 
    size 500k
    rotate 3
    compress
    missingok
    create 0600 root root
}

I have also created a file inside /etc/cron.hourly folder called logrotateTomcat with below content:

#!/bin/sh

/usr/sbin/logrotate /etc/logrotate.d/tomcat >/dev/null 2>&1
EXITVALUE=$?
if [ $EXITVALUE != 0 ]; then
    /usr/bin/logger -t logrotate "ALERT exited abnormally with [$EXITVALUE]"
fi
exit 0

If I run the command /etc/cron.hourly/logrotateTomcat it rotate the log file and compress it. It also maintains the rotate count if I run manually multiple times. But it does not do the same automatically my log entry looks like as below in /var/log/cron which says task has ran but it does not rotate the file.

ar 15 06:01:01 adaptapppsdev run-parts(/etc/cron.hourly)[16107]: starting logrotateTomcat
Mar 15 06:01:01 adaptapppsdev run-parts(/etc/cron.hourly)[16124]: finished logrotateTomcat
Mar 15 06:01:01 adaptapppsdev run-parts(/etc/cron.hourly)[16107]: starting mcelog.cron
Mar 15 06:01:01 adaptapppsdev run-parts(/etc/cron.hourly)[16139]: finished mcelog.cron
Mar 15 06:10:01 adaptapppsdev CROND[16273]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Mar 15 06:20:01 adaptapppsdev CROND[16423]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Mar 15 06:30:01 adaptapppsdev CROND[16567]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Mar 15 06:40:01 adaptapppsdev CROND[16713]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Mar 15 06:50:01 adaptapppsdev CROND[16859]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Mar 15 07:00:01 adaptapppsdev CROND[17005]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Mar 15 07:01:01 adaptapppsdev CROND[17025]: (root) CMD (run-parts /etc/cron.hourly)
Mar 15 07:01:01 adaptapppsdev run-parts(/etc/cron.hourly)[17025]: starting 0anacron
Mar 15 07:01:01 adaptapppsdev run-parts(/etc/cron.hourly)[17034]: finished 0anacron
Mar 15 07:01:01 adaptapppsdev run-parts(/etc/cron.hourly)[17025]: starting logrotateTomcat
Mar 15 07:01:01 adaptapppsdev run-parts(/etc/cron.hourly)[17042]: finished logrotateTomcat
Mar 15 07:01:01 adaptapppsdev run-parts(/etc/cron.hourly)[17025]: starting mcelog.cron
Mar 15 07:01:01 adaptapppsdev run-parts(/etc/cron.hourly)[17057]: finished mcelog.cron
Mar 15 07:10:01 adaptapppsdev CROND[17187]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Mar 15 07:20:01 adaptapppsdev CROND[17333]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Mar 15 07:30:02 adaptapppsdev CROND[17479]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Mar 15 07:40:01 adaptapppsdev CROND[17625]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Mar 15 07:50:01 adaptapppsdev CROND[17772]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Mar 15 08:00:01 adaptapppsdev CROND[17954]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Mar 15 08:01:01 adaptapppsdev CROND[17977]: (root) CMD (run-parts /etc/cron.hourly)
Mar 15 08:01:01 adaptapppsdev run-parts(/etc/cron.hourly)[17977]: starting 0anacron
Mar 15 08:01:01 adaptapppsdev run-parts(/etc/cron.hourly)[17986]: finished 0anacron
Mar 15 08:01:01 adaptapppsdev run-parts(/etc/cron.hourly)[17977]: starting logrotateTomcat
Mar 15 08:01:01 adaptapppsdev run-parts(/etc/cron.hourly)[17994]: finished logrotateTomcat
Mar 15 08:01:01 adaptapppsdev run-parts(/etc/cron.hourly)[17977]: starting mcelog.cron
Mar 15 08:01:01 adaptapppsdev run-parts(/etc/cron.hourly)[18009]: finished mcelog.cron
Mar 15 08:10:01 adaptapppsdev CROND[18168]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Mar 15 08:14:04 adaptapppsdev crontab[18230]: (root) LIST (root)
Mar 15 08:20:01 adaptapppsdev CROND[18327]: (root) CMD (/usr/lib64/sa/sa1 1 1)
Mar 15 08:30:01 adaptapppsdev CROND[18473]: (root) CMD (/usr/lib64/sa/sa1 1 1)

Please help me if I am missing something.

Answer 1

SELinux denies logrotate to check the attributes of the rotated log file, this happens when logrotate has to rotate files outside of /var/log (defined in logrotate.conf). logrotate indeed sends a logger message logrotate: ALERT exited abnormally with [1] because of SELinux, but it doesn't stop logrotate from completing successfully. Solutuion:

semanage fcontext -a -t var_log_t '/opt/<apachetomcat>/logs(/.*)?'

and then

cat /etc/selinux/targeted/contexts/files/file_contexts.local
# This file is auto-generated by libsemanage
# Do not edit directly.

opt/<apachetomcat>/logs(/.*)?    system_u:object_r:var_log_t:s0

finally

# restorecon -Frvv opt/<apachetomcat>/logs

That will do everything you need to rotate log outside /var/log