2

I have this conf for my logrotate:

/tmp/snmp.log {
    daily
    rotate 12
    missingok
    notifempty
    copytruncate
    dateext

}

but it won't truncate the original file. it logrotates but keeps on appending to the original file.

4

Rotating a log file is not sufficient, you have to tell the process that's writing to it to stop as well. You typically can do this by sending a signal to the process, such as a HUP.

Example

/var/log/snmpd.log {
    notifempty
    missingok
    postrotate
        /bin/kill -HUP `cat /var/run/snmpd.pid 2> /dev/null` 2> /dev/null || true
    endscript
}

This will use the kill command to send the -HUP signal (aka. a Hang Up) to the SNMP daemon whose process ID is contained in the file snmpd.pid.

NOTE1: Moving a file simply relocates the file on disk, but any file descriptors already assigned to any running processes are still active, and will continue to write output to the new name of the file regardless.

NOTE2: Also you can use the kill command and its -l switch to get a full list of signals that you can send to running processes.

What happens when you HUP?

Sending a running process, such as the SNMP daemon, a HUP (aka. SIGHUP) signal instructs the process to reload its configuration files, typically. When this occurs the process will then open a file for writing, say some log file.

Upon opening this file, the daemon will use whatever name it's configured to use in the config file. This is what causes the daemon to start writing to the original name of the log file.

Doing this after the original log file has been moved to a different name causes the daemon to severe ties to it (through the original file descriptor). When the daemon re-reads its config file, it will create and then start writing any new log messages to a new log file, leaving the previous logfile in place (under its changed name).

It is this behavior that log rotation is exploiting.

  • I have other process that is only being triggered when an event is found. How will i kill that using pid? – user60216 Mar 3 '14 at 3:38
  • @user60216 - please elaborate in your Q, it's unclear what you're saying. – slm Mar 3 '14 at 3:42
  • For the snmpd.log, yes I have the file snmpd.pid, but what about for the other process that I would want to rotate the same way that snmpd.log is rotating (truncated after rotation). I can't find their corresponding *.pid file. – user60216 Mar 3 '14 at 8:27
  • @user60216 - Are they running processes? The .pid file is just "one way" to get at the processes ID. You can use other methods such as $(pgrep snmpd) for example. But I'm still foggy on what you're actually doing. Sorry must need like 3 cups of coffee 8-) – slm Mar 3 '14 at 12:27
  • Would it be okay to send kill -HUP and then remove the file (so I can make sure that the log files restarts to 0bytes)? The process link to the log file is continuously running and accessing this log. – user60216 Mar 4 '14 at 6:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.