Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Is there any way to keep file size of log file fixed without rotating it by a new empty file and deleting (or archiving) the old file. For example, if I set log file maximum size to 1MB, after the file size increase beyond that limit it will be automatically clamped, the text is added on 'tail' and the oldest part of text is poped out to keep the file size 1MB.

share|improve this question
    
use logrotate, then rm -f *.tar.gz.* –  Marco Ceppi Aug 12 '10 at 23:03
1  
Is there any particular reason why you don't want to rotate the log, or use logrotate? Exactly what do you want to happen? Archive the old log at 1M and start a new one? The start of your question isn't quite compatible with the end. –  David Thornley Aug 13 '10 at 12:27
    
what does poped out mean? –  Tshepang May 20 '11 at 14:38
    
Related question: rotating buffer type file logging utility –  Caleb Aug 5 '11 at 14:35
add comment

5 Answers

up vote 3 down vote accepted

You could write a little bash script to do this. Just tail the file to a certain byte count using tail -c and overwrite the file.

from man tail:

-c, --bytes=N
              output the last N bytes; alternatively, use +N to  output  bytes
              starting with the Nth of each file

   If  the  first  character of N (the number of bytes or lines) is a `+',
   print beginning with the Nth item from the start of each  file,  other‐
   wise, print the last N items in the file.  N may have a multiplier suf‐
   fix:  b  512,  kB  1000,  K  1024,  MB  1000*1000,  M   1024*1024,   GB
   1000*1000*1000, G 1024*1024*1024, and so on for T, P, E, Z, Y.
share|improve this answer
2  
I am relatively sure that once you "overwrite the file" the logging will not resume automatically on the new file. –  Stephen Jazdzewski Aug 13 '10 at 14:41
add comment

Your only solution may be to write your own userspace file system or contribute to an existing one. Look at the partial list at Filesystem in Userspace

If you don't have the skills to contribute, offer a project publicity or $$$ or both, to add it for you.

I wish I had the time to do it, I have always wanted something exactly like this.

share|improve this answer
add comment

You can do something similar using a FIFO, which is sort of like a zero-byte sized file.

However, note that if nothing is READING from this file, then the syslog process may become blocked, and will stop writing to ALL of your logfiles. I'm not sure if this behavior has been changed with newer versions of Ubuntu/CentOS.

One example here

For another example, try something like this.

Make your FIFO:

sudo mkfifo /var/log/everything.fifo

And add this to (r)syslog.conf, then restart syslog:

*.*     |/var/log/everything.fifo

Then view the FIFO from one window:

cat /var/log/everything.fifo

And in another window, send some stuff to syslog:

logger Test1
logger Test2
logger Test3

You should see the "Test*" lines in the output of cat above.

This feature can be great for debugging, especially if you don't care to keep the data around for longer. For example, if you only want to see everything except for thefirewall spam, you can do something like this:

grep -vi "kernel: .* on wan" /var/log/everything.fifo
share|improve this answer
add comment

Here's my second answer. This is a pretty hackish.

Use watch(1) to repeatedly execute tail --bytes=1024 (the last 1024 bytes of the logfile, thanks to @jjclarkson for that answer).

watch --no-title tail --bytes=1024 /var/log/messages >/tmp/messages.watch

And then view the file with:

less --raw-control-chars /tmp/messages.watch

The difference between watch and a while loop is that watch will only update /tmp/messages.watch if there were changes to /var/log/messages .

while true; do
    tail --bytes=1024 /var/log/messages > /tmp/messages.watch
    sleep 1
done

And well, I guess you could put a test in the while loop so that tail is only executed if /var/log/messages was updated, but I won't figure that out now.

share|improve this answer
add comment
 *      prune - clips off the tops of a list of files described in the
 *              file /etc/default/prune. Designed to be run periodically
 *              from cron, the idea is to automatically shorten log
 *              files that grow forever. This file contains a list of
 *              files (full pathname), and the number of blocks that
 *              should be retained.  To retain some sanity, prune will
 *              clip the file after the next newline. The file
 *              /etc/default/prune should look something like:
 *
 *                      /usr/adm/aculog         10
 *                      /usr/adm/leo.log        5
 *                      /usr/adm/messages       200
 *                      /usr/adm/sup_log        5
 *
 *              The crontab entry on infoswx for prune looks like:
 *
 *                      0 5 * * * /etc/prune >/usr/adm/prune.log 2>&1
 *
 *              Compile with:  cc -O -o prune prune.c
 *
 *              The following defines may be adjusted to suit your taste
 *              and your system block size.
 *
 *      Ray Davis  infoswx!bees  09/25/85

https://groups.google.com/group/mod.sources/browse_thread/thread/b2136b3ab7e924e/f785b37c218bb576?hl=en&ie=UTF-8&q=prune+log+file&pli=1

Many (most? all?) daemons will re-open their log files if sent a HUP signal (e.g. by same cron job that runs prune)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.