I run a script that modifies /var/log/security.

If someone tries to connect to my server via ssh, this event writes into /var/log/security.( I have set firewall_enable="YES" and firewall_logging="YES" in /etc.rc.conf)

The script finds and marks certain lines by adding to the end of the line some symbols (For example, symbol ! ).

But after changing the file /var/log/security ipfw events are not written to it any more. Only /etc/rc.d/syslogd restart does help. What can I do?

1 Answer 1


it's normal. Your process doesn't know filename, is only know file-descriptor. So if you delete the file and create a new one with the same name, the process will continues to write into the file descriptor of the former file. it is required to restart the process so that the new file descriptor is loaded and used from the file name.

So if you dont want to change the file descriptor and clean the content of the file, without restarting the process, you can try something like echo "">/var/log/filename this command will erase the content of the filename without changing the file descriptor. (must be tested first of course)

  • can you please validate my answer if satisfied!!!
    – netmonk
    Commented Aug 7, 2019 at 8:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .