I have a separate file for logging local7 facility, and this file is touched and permissions set, from my installer. But sometimes I see that the logs are not being written to it (after I do a re-install) until I do rsyslog restart!

Is it mandatory to restart rsyslog if the log file is touched by another program/application ?

(since the installer is run as root, the log file's time-stamp will be changed due to touch - will this cause rsyslog to not write to the log file ?)

2 Answers 2


rsyslogd has each log file open continuously for writing and it doesn't know that you've yanked the file out from under it. The file your installer removed is still on disk in an unlinked state and is still being written to. You can tell rsyslogd to reopen all log files by killall -HUP rsyslogd instead of doing a full restart.

  • my installer is not removing the file, its just doing a touch + chmod - for this too, do I need a kill -HUP ?
    – Ani
    Oct 8, 2014 at 12:59
  • 1
    @vyom Your installer is creating a new file via touch according to your post. If you create a new file you will need to send a HUP to rsyslogd or restart it. If you are just changing a timestamp or permissions then you do not need to do anything.
    – doneal24
    Oct 8, 2014 at 16:34
  • ok, I meant touch, I have edited the question, to keep it simple, the installer always does a touch <file> and then chmod on it. So, from your explanation I dont need a HUP, but somehow I see this issue that after an installation the logging not happening until I restart rsyslog !
    – Ani
    Oct 8, 2014 at 17:00
  • If rsyslog has a lock on the file, then your script can not write to it (including touch and chmod functions) until the lock is released. You have to (briefly) end that lock on the file, perform your touch and chmod changes, and then resume rsyslog (which, then again, creates a continuous lock on that file). Got it?
    – ILMostro_7
    Jan 25, 2020 at 17:52

For obvious reasons, rsyslog is a rigidly designed program that follows its configuration. It's unambiguous. If it was possible to do what you want to do, it would make a giant security hole.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .