22

I have a process running that writes standard output and standard error to a log file /var/log/dragonturtle.log. Is there anyway to rotate the log file, and have the process continuing to write to the new log file without killing the process?

What happens currently (given the logrotate config below):

  • Process writes to /var/log/dragonturtle.log
  • Logrotate moves /var/log/dragonturtle.log to /var/log/dragonturtle.log.1
  • Process continues to write to /var/log/dragonturtle.log.1

What I would like to happen:

  • Process writes to /var/log/dragonturtle.log
  • Logrotate copies /var/log/dragonturtle.log to /var/log/dragonturtle.log.1
  • Logrotate truncates /var/log/dragonturtle.log
  • Process continues to write to /var/log/dragonturtle.log

/etc/logrotate.d/dragonturtle:

/var/log/dragonturtle.log {
    daily
    missingok
    rotate 7
    compress
    delaycompress
    notifempty
    create 644 dragonturtle dragonturtle
}

2 Answers 2

23

The logrotate option that does what you describe is copytruncate. Simply add this option to your existing logrotate config. Here is the excerpt from the logrotate.conf manual:

   copytruncate
          Truncate  the  original log file in place after creating a copy,
          instead of moving the old log file and optionally creating a new
          one,  It  can be used when some program can not be told to close
          its logfile and thus might continue writing (appending)  to  the
          previous log file forever.  Note that there is a very small time
          slice between copying the file and truncating it, so  some  log-
          ging  data  might be lost.  When this option is used, the create
          option will have no effect, as the old log file stays in  place.
5
  • I was going to suggest something way more complicated involving inode checks and forked processes, but this is WAY simpler.
    – Jeight
    Aug 1, 2014 at 22:43
  • It is simpler but you can lose some data. Any alternative that guarantees no data is lost?
    – Guido
    May 3 at 12:23
  • @Guido Instead of logging to a file you could have the program log directly TCP to a logging daemon like fluentd or logstash which can handle indexing/rotation itself. I don't think there are other options with just logrotate.
    – jordanm
    May 3 at 14:57
  • Thanks @jordanm. Logging to a TCP endpoint is a good idea to avoid logrotate. However, we use the file as a buffer to increase our resilience when the network is down. The alternative you propose would also lose data in that case.
    – Guido
    May 17 at 11:08
  • @Guido You can log to local fluentd daemon which has support for file buffering.
    – jordanm
    May 17 at 16:16
0

Please note that while using copytruncate option to your logrotate conf file, one might lose some log lines as there is a small time delay involved in truncating the old file and telling the process to write to the same file. It is not suitable for some applications which writes logs for every other milliseconds.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .