1

I have multiple log files abc-log,abc-log.1, and abc-log.2 rotated by logrotate utility. Among these rotated log files which is the log file which contains the recent logs? Is it abc-log or abc-log.1?

1
  • 1
    Why not do a ls -l and find out by looking at the timestamp reported there?
    – steve
    Commented Dec 8, 2015 at 7:39

1 Answer 1

2

abc-log would contain the currently incoming log data; abc-log.1 would be the newest file that is safe to remove or compress. (You can also look at the timestamp of the files to double-check.)

This is, of course, assuming you don't use software which logs to abc-log.1 directly, but that would be a near-malicious break of convention, I guess.

I should point out that rotating logs requires the program to be able to re-open its logfiles (so logrotate can rename the old one and the program will log to the new one), the docs on the copytruncate configuration option might be helpful here:

copytruncate

Truncate the original log file in place after creating a copy, instead of moving the old log file and optionally creating a new one. It can be used when some program cannot be told to close its logfile and thus might continue writing (appending) to the previous log file forever. Note that there is a very small time slice between copying the file and truncating it, so some logging data might be lost. When this option is used, the create option will have no effect, as the old log file stays in place.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .