I have this conf for my logrotate:
/tmp/snmp.log {
daily
rotate 12
missingok
notifempty
copytruncate
dateext
}
but it won't truncate the original file. it logrotates but keeps on appending to the original file.
I have this conf for my logrotate:
/tmp/snmp.log {
daily
rotate 12
missingok
notifempty
copytruncate
dateext
}
but it won't truncate the original file. it logrotates but keeps on appending to the original file.
Rotating a log file is not sufficient, you have to tell the process that's writing to it to stop as well. You typically can do this by sending a signal to the process, such as a HUP.
/var/log/snmpd.log {
notifempty
missingok
postrotate
/bin/kill -HUP `cat /var/run/snmpd.pid 2> /dev/null` 2> /dev/null || true
endscript
}
This will use the kill
command to send the -HUP
signal (aka. a Hang Up) to the SNMP daemon whose process ID is contained in the file snmpd.pid
.
NOTE1: Moving a file simply relocates the file on disk, but any file descriptors already assigned to any running processes are still active, and will continue to write output to the new name of the file regardless.
NOTE2: Also you can use the kill
command and its -l
switch to get a full list of signals that you can send to running processes.
Sending a running process, such as the SNMP daemon, a HUP (aka. SIGHUP) signal instructs the process to reload its configuration files, typically. When this occurs the process will then open a file for writing, say some log file.
Upon opening this file, the daemon will use whatever name it's configured to use in the config file. This is what causes the daemon to start writing to the original name of the log file.
Doing this after the original log file has been moved to a different name causes the daemon to severe ties to it (through the original file descriptor). When the daemon re-reads its config file, it will create and then start writing any new log messages to a new log file, leaving the previous logfile in place (under its changed name).
It is this behavior that log rotation is exploiting.
.pid
file is just "one way" to get at the processes ID. You can use other methods such as $(pgrep snmpd)
for example. But I'm still foggy on what you're actually doing. Sorry must need like 3 cups of coffee 8-)
– slm♦
Mar 3 '14 at 12:27