· about 30 minutes · runs on ubuntu-26.04-container · unrated
An unrated lab. It runs on your machine with no account and no network, and everything about it — the faults, the checks, the hints and the reference solution — is in the repository. An attempt on it is recorded on your profile and never moves a rating: only rated labs do. Rated and unrated labs.
The shop's order service writes to /var/log/shop/app.log as the system user shop. The file is
300 MB and growing. There is a logrotate policy for it in /etc/logrotate.d/shop, and logrotate
runs every night — yet the log has never been rotated, and the only time someone forced it by hand
the service stopped logging until a restart.
This lab runs in a container: no boot, no cron daemon, nothing to reboot. Run logrotate yourself
to see what the nightly job would do (-d shows it without touching anything). You are learner
with sudo. /usr/local/bin/shop-log writes one line as shop, the way the service does.
What is expected, and graded — rotation is tried against a copy of your policy, in a scratch
directory set up like /var/log/shop, so the grader never rotates your real logs:
/etc/logrotate.d/shop instead of ignoring it./var/log/shop.shop can still write to app.log.app.log has actually been rotated: it is small now, and its history is beside it.Do not solve it by making /var/log/shop root's: the service writes there.
This lab runs in a container — Docker or Podman, no VM — so there is no boot to survive: the checks run once, against the state you left.
| Check | Objective |
|---|---|
| 01_the_config_is_not_ignored | Find out why logrotate ignores or skips a configuration |
| 02_rotation_is_allowed_there | Find out why logrotate ignores or skips a configuration |
| 03_the_app_writes_after_rotation | Rotate a log without locking out the program that writes it |
| 04_a_week_of_compressed_history | Keep a bounded, compressed history |
| 05_the_big_log_is_rotated | Rotate the oversized log now |
Where the lab's hints send you, level by level, as you ask for them (h, then l opens a journal section in the TUI).
4 questions on the same topic, in the lab's Theory tab. They never affect the lab's grade. Three of them, to answer here:
logrotate reports "skipping /var/log/shop/app.log because parent directory has insecure permissions". The directory is drwxrwxr-x shop:shop and the service writes there. The right fix?
Add su shop shop to the policy
logrotate will not rename or create files as root in a directory another user can write, because that user could swap in a symlink. With su it acts as shop, and the directory stays the service's, which it must be.
man 8 logrotate (su)
A program keeps its log open and never reopens it. The policy uses create, with no postrotate. After a rotation, where do its new lines go?
Into the renamed file, app.log.1
A descriptor refers to the file, not its name. After the rename the program still writes to what is now app.log.1, which is later compressed and deleted. Signal it to reopen in postrotate, or use copytruncate.
man 8 logrotate (create, copytruncate, postrotate) · man 2 rename
What does this print?
truncate -s 300M app.log
echo "$(stat -c %s app.log) $(du -k app.log | cut -f1)"
314572800 0
truncate extends the file with a hole: its apparent size is 300 MiB, but no blocks are allocated, so du reports nothing. logrotate's size rule compares the apparent size.
man 1 truncate · man 1 du · man 2 stat · executed in a sandbox