[syslog-ng]deleting log files - syslog-ng]

[todd glassey]

You might also want to try using lsof to see who and what has the log file
pinned open (although it should be obvious) if your OS freezes the file
context in open mode while that instance of the application is running.

T
----- Original Message -----
From: "Mikko Niskanen" <mikko.niskanen@soon.fi>
To: <syslog-ng@lists.balabit.hu>
Sent: Friday, October 26, 2001 4:31 AM
Subject: RE: [syslog-ng]deleting log files - syslog-ng]


> > On Fri, Oct 26, 2001 at 12:11:48PM +0200, Thomas Kaehn wrote:
> > > cp /some/where/file.log /some/where/old/file.log.old
> > > cp /dev/null /some/where/file.log
> > > This way, file still exists and file descriptos are not closed.
> > > However, this is not atomic, one might lose logged lines before
> > > file is truncated.
> > Better idea:
> > mv logfile logfile.old
> > kill -WHATEVER syslog-ng
> > This way it would continue writing into the moved file until I restart
it
> > which would flush buffers, close the file and then crate a new one.
>
> That's correct. But, if you'd prefer not restarting syslog-ng,
> then one might use cp. On our case, we have another process
> parsing the syslog output, hence mv'ing logfile and restarting
> syslog-ng necessitates restarting the parser process as well...
>
> > But a fstat() call at each write would be a more elegant solutuion if it
> > doesn't slow down writing too much.
>
> Can't comment this performance issue, perhaps Bazsi has given it
> a thought?
>
> -MNi
>
>
>
> _______________________________________________
> syslog-ng maillist  -  syslog-ng@lists.balabit.hu
> https://lists.balabit.hu/mailman/listinfo/syslog-ng