Re: [logs] Log rotation tools

From: Steffen Kluge (klugeat_private)
Date: Thu Sep 13 2001 - 17:52:18 PDT

  • Next message: Karyl F. Stein: "RE: [logs] Log rotation tools"

    On Thu, Sep 13, 2001 at 09:33:56AM -0400, Marcus J. Ranum wrote:
    > >homebrew: cp logfile logfile.$TODAY && cp /dev/null logile
    > 
    > It's probably better to use
    > touch logfile
    > instead of
    > cp /dev/null logfile
    > on the outside chance that something has actually been written to
    > the log file. Also, usually, this is done with the 'mv' command, which
    > is faster and less likely to result in more data piling up in the
    > old logfile. So what I'd suggest looks more like:
    > 
    > mv logfile logfile.$TODAY && touch logfile
    
    However, this leaves you with a *new* logfile (new inode
    altogether, new file handle to be obtained, etc). Many programs
    producing logging output can't deal with this, that's why tools
    like logrotate have to restart them after rotating their log
    files. In the example above, without restart, programs like
    syslogd will continue writing to logfile.$TODAY, which may have
    changed it's name but that doesn't matter a bit. Assuming, of
    course, that both files live in the same filesystem, i.e. mv is
    truly a mv and not a cp+rm.
    
    I've been using something like this successfully for while now:
    
    gzip -c logfile > logfile.$TODAY.gz && cat /dev/null > logfile
    
    which is essentially the same as the example using copies, and
    doesn't change inode, file handle or whatever of the log file in
    use, it just truncates it to zero length. I realise that there is
    still a time window during which I could lose logging output:
    between gzip (or whatever) seeing EOF, and the truncation.
    
    Cheers
    Steffen.
    
    
    ---------------------------------------------------------------------
    To unsubscribe, e-mail: loganalysis-unsubscribeat_private
    For additional commands, e-mail: loganalysis-helpat_private
    



    This archive was generated by hypermail 2b30 : Thu Sep 13 2001 - 18:39:55 PDT