On Fri, Oct 26, 2001 at 12:11:48PM +0200, Thomas Kaehn wrote:
cp /some/where/file.log /some/where/old/file.log.old cp /dev/null /some/where/file.log This way, file still exists and file descriptos are not closed. However, this is not atomic, one might lose logged lines before file is truncated.
Better idea: mv logfile logfile.old kill -WHATEVER syslog-ng This way it would continue writing into the moved file until I restart it which would flush buffers, close the file and then crate a new one.
That's correct. But, if you'd prefer not restarting syslog-ng, then one might use cp. On our case, we have another process parsing the syslog output, hence mv'ing logfile and restarting syslog-ng necessitates restarting the parser process as well...
But a fstat() call at each write would be a more elegant solutuion if it doesn't slow down writing too much.
Can't comment this performance issue, perhaps Bazsi has given it a thought? -MNi