logrotate won't truncate original file

Question

I have this conf for my logrotate:

/tmp/snmp.log {
    daily
    rotate 12
    missingok
    notifempty
    copytruncate
    dateext

}

but it won't truncate the original file. it logrotates but keeps on appending to the original file.

Answer 1

Rotating a log file is not sufficient, you have to tell the process that's writing to it to stop as well. You typically can do this by sending a signal to the process, such as a HUP.

Example

/var/log/snmpd.log {
    notifempty
    missingok
    postrotate
        /bin/kill -HUP `cat /var/run/snmpd.pid 2> /dev/null` 2> /dev/null || true
    endscript
}

This will use the kill command to send the -HUP signal (aka. a Hang Up) to the SNMP daemon whose process ID is contained in the file snmpd.pid.

NOTE1: Moving a file simply relocates the file on disk, but any file descriptors already assigned to any running processes are still active, and will continue to write output to the new name of the file regardless.

NOTE2: Also you can use the kill command and its -l switch to get a full list of signals that you can send to running processes.

What happens when you HUP?

Sending a running process, such as the SNMP daemon, a HUP (aka. SIGHUP) signal instructs the process to reload its configuration files, typically. When this occurs the process will then open a file for writing, say some log file.

Upon opening this file, the daemon will use whatever name it's configured to use in the config file. This is what causes the daemon to start writing to the original name of the log file.

Doing this after the original log file has been moved to a different name causes the daemon to severe ties to it (through the original file descriptor). When the daemon re-reads its config file, it will create and then start writing any new log messages to a new log file, leaving the previous logfile in place (under its changed name).

It is this behavior that log rotation is exploiting.