I think I have identified the root cause of this issue...
I looked at the time stamps for the /var/log/*.bz2 files on about a dozen SLES systems this morning (some Zimbra hosts, some not), and saw that the log files being rotated by scripts in /etc/cron.daily had time stamps of roughly on the hour and fifteen/thirty/forty-five minutes after the hour -- and that the hours were all pretty random. There was no correlation between time zones at all.
I also noticed that the time of day the files were rotated changed by an hour when Daylight Savings Time kicked in.
The new Zimbra logging system as I understand it, including the daily mail report and statistics in the Admin console, relies on data in /var/log/zimbra.log and /var/log/zimbra-stats.log being available to parse.
When these log files are rotated in the middle of the day, the data in the daily mail report and stats in the Admin Console is incomplete.
So why are these log files being rotated by scripts in /etc/cron.daily on such a seemingly random basis?
Because unless the "DAILY_TIME" parameter in /etc/sysconfig/cron is set to a specific time, cron.daily is run by default at the next 15 minute interval past the last boot time hour -- until the server is once again rebooted.
On all the SLES systems I looked at, "DAILY_TIME" was blank.
Consequently, /etc/cron.daily/zimbra is being executed each day based on the last boot time of the server.
This is not what Zimbra I believe intends :rolleyes: so I have filed a bug report here: Bug
43847 – Incorrect Log File Rotation Method Causing Missing Data in Daily Admin Report and Admin Console Stats Pages
Would be interesting if admins using other distros could comment on their setups here as well...
Hope that helps,