0

I am trying to monitor a log file which rotates frequently by logrotate. but i am unable to get that correctly. can any one explain how actually logrotate works?

Is a file renamed and a new file is created ?

or is a file copied with a new name and the current file is emptied?

Before rotation:

131887 -rw-r--r-- 1 root root  11385 Sep 25 03:40 /var/log/sas.log

After rotation:

131887 -rw-r--r-- 1 root root  0 Sep 25 04:40 /var/log/sas.log

131911 -rw-r--r-- 1 root root   11385 Sep  25 04:40 /var/log/sas.log.1
Quaxton Hale
  • 175
  • 5
  • 18
Suriya Vijayaraghavan
  • 41

2 Answers2

3

If the option truncate is enabled in configuration file, then the file will not be moved - its content will only be copied to another file which is newly created and the current file will be cleared, so the inode id will not change. Actually the file is never changed.

Jeyanthan I
  • 295
Suriya Vijayaraghavan
  • 41
2

Upon rotation the current logfile is moved and possibly compressed if that is specified. Then it is created anew. [looking for a source other than my experience]

That is a problem if a service is running that has the log file opened at the time of rotation. The file will be unlinked, but the disk space not really freed because the file is still open.

That is why services often install a more elaborate logrotate script handling the rotation. As an example look at /etc/logrotate.d/nginx defining rotation behaviour for the nginx webserver:

[....]
postrotate
    invoke-rc.d nginx rotate >/dev/null 2>&1
endscript

The postrotate block is executed after the new log file has been created. It invokes the service script of nginx with rotate telling the service to reopen its log file.

Nephente
  • 5,595
  • 1
  • 17
  • 23
  • ¨current logfile is moved" Nope. It is copied, the old file gets emptied (moving would leave a slight option for the software that uses the log file to crash due to it expecting the log to be there). – Rinzwind Oct 30 '15 at 11:03