You might also want to try using lsof to see who and what has the log file pinned open (although it should be obvious) if your OS freezes the file context in open mode while that instance of the application is running. T ----- Original Message ----- From: "Mikko Niskanen" <mikko.niskanen@soon.fi> To: <syslog-ng@lists.balabit.hu> Sent: Friday, October 26, 2001 4:31 AM Subject: RE: [syslog-ng]deleting log files - syslog-ng]
On Fri, Oct 26, 2001 at 12:11:48PM +0200, Thomas Kaehn wrote:
cp /some/where/file.log /some/where/old/file.log.old cp /dev/null /some/where/file.log This way, file still exists and file descriptos are not closed. However, this is not atomic, one might lose logged lines before file is truncated. Better idea: mv logfile logfile.old kill -WHATEVER syslog-ng This way it would continue writing into the moved file until I restart it which would flush buffers, close the file and then crate a new one.
That's correct. But, if you'd prefer not restarting syslog-ng, then one might use cp. On our case, we have another process parsing the syslog output, hence mv'ing logfile and restarting syslog-ng necessitates restarting the parser process as well...
But a fstat() call at each write would be a more elegant solutuion if it doesn't slow down writing too much.
Can't comment this performance issue, perhaps Bazsi has given it a thought?
-MNi
_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng