Date: Sat, 3 Aug 2013 18:27:35 -0500 From: Dan Nelson <dnelson@allantgroup.com> To: Frank Leonhardt <freebsd-doc@fjl.co.uk> Cc: freebsd-questions@freebsd.org Subject: Re: Archiving a log file Message-ID: <20130803232735.GC47411@dan.emsphone.com> In-Reply-To: <51FD8E19.90403@fjl.co.uk> References: <51FD8E19.90403@fjl.co.uk>
next in thread | previous in thread | raw e-mail | index | archive | help
In the last episode (Aug 04), Frank Leonhardt said: > The answer isn't (AFAIK) newsyslog > > As a one-off, I need to archive an old log file - say httpd-access.log - > while its still open. I don't want this to happen automatically and I > don't want to set up newsyslog or anything like that. And I really don't > want to mess about with signals to whatever is writing to the file, even > assuming the writer could respond to them. I can't just rename the file > as it's open for writing, and there would also be a good chance that > something will be added to the file while it's being compressed. > > What I actually do is: > > cp httpd-access.log httpd-access.log-03-Aug-13 && :> httpd-access.log && bzip2 httpd-access.log-03-Aug-13 > > Data might be lost here as something may be added between the cp being > completed and the file being truncated. It's not the end of the world if > this happens, but is there a better way? I could always shut down Apache > for the duration, but I don't want to do that either, so in this case I'm > happy to take the risk (it's not like I'm likely to miss anything that > important). > > I don't know if this can be relied on as a POSIX thing, but the cp command > simply(!) issues read() and write() calls until read() fails to get any > more bytes, so if data is being appended to the file after cp is started > it'll still be copied. Therefore the window where stuff could be written > after the copy but before the truncation is shortened, but extant. > > So what's the magic utility I don't know about? newsyslog :) It renames the active logfile to a new name, sends the process a signal (syslog and SIGHUP by default) letting it know that it should close and reopen its logfile (creating a new one), then gzips the renamed file. In Apache's case, just specify the path to apache's pidfile in your newsyslog.conf, and everything should just work. Don't be afraid of signals. Without signalling the logging process to switch to a new logfile, and without suspending the process while you do your copy, there's always going to be a window where you risk losing logged data. -- Dan Nelson dnelson@allantgroup.com
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20130803232735.GC47411>