On Thu, Sep 13, 2001 at 09:33:56AM -0400, Marcus J. Ranum wrote: > >homebrew: cp logfile logfile.$TODAY && cp /dev/null logile > > It's probably better to use > touch logfile > instead of > cp /dev/null logfile > on the outside chance that something has actually been written to > the log file. Also, usually, this is done with the 'mv' command, which > is faster and less likely to result in more data piling up in the > old logfile. So what I'd suggest looks more like: > > mv logfile logfile.$TODAY && touch logfile However, this leaves you with a *new* logfile (new inode altogether, new file handle to be obtained, etc). Many programs producing logging output can't deal with this, that's why tools like logrotate have to restart them after rotating their log files. In the example above, without restart, programs like syslogd will continue writing to logfile.$TODAY, which may have changed it's name but that doesn't matter a bit. Assuming, of course, that both files live in the same filesystem, i.e. mv is truly a mv and not a cp+rm. I've been using something like this successfully for while now: gzip -c logfile > logfile.$TODAY.gz && cat /dev/null > logfile which is essentially the same as the example using copies, and doesn't change inode, file handle or whatever of the log file in use, it just truncates it to zero length. I realise that there is still a time window during which I could lose logging output: between gzip (or whatever) seeing EOF, and the truncation. Cheers Steffen. --------------------------------------------------------------------- To unsubscribe, e-mail: loganalysis-unsubscribeat_private For additional commands, e-mail: loganalysis-helpat_private
This archive was generated by hypermail 2b30 : Thu Sep 13 2001 - 18:39:55 PDT