openvpn logrotate

Question

I'm trying to rotate OpenVPNs logfiles every month. The problem seems to be that simply renaming the files doesn't do the trick. The data still gets written to the old file (which indicates that the logfile is kept open and logging still writes to the old file object).

So now I wrote a script that restarts openvpn at the beginning of every month after it updates a symlink to the new log file's location.

But this script seems to be buggy and sometimes fails to start the server correctly (tun0 is down sometimes).

So I wanted to ask if one of you knows a better way to achieve log rotation in OpenVPN?

Edit: I'm using Debian Squeeze and my restart script already sleeps 5 seconds between stopping and starting the ovpn server

Answer 1

There are two methods to handling this situation. The ideal way by having logrotate notify the process, either via signal or by restarting the process via the postrotate directive. The other way is using the copytruncate. The copytruncate method should work in your situation. Here is the description from the documentation:

   copytruncate
          Truncate  the  original log file in place after creating a copy,
          instead of moving the old log file and optionally creating a new
          one,  It  can be used when some program can not be told to close
          its logfile and thus might continue writing (appending)  to  the
          previous log file forever.  Note that there is a very small time
          slice between copying the file and truncating it, so  some  log-
          ging  data  might be lost.  When this option is used, the create
          option will have no effect, as the old log file stays in  place.

Answer 2

How about workaround to logging into syslog?

See usage --daemon [progname] (or --syslog [progname]) in man openvpn (http://openvpn.net/index.php/open-source/documentation/manuals/65-openvpn-20x-manpage.html)