22

I have a process running that writes standard output and standard error to a log file /var/log/dragonturtle.log. Is there anyway to rotate the log file, and have the process continuing to write to the new log file without killing the process?

What happens currently (given the logrotate config below):

  • Process writes to /var/log/dragonturtle.log
  • Logrotate moves /var/log/dragonturtle.log to /var/log/dragonturtle.log.1
  • Process continues to write to /var/log/dragonturtle.log.1

What I would like to happen:

  • Process writes to /var/log/dragonturtle.log
  • Logrotate copies /var/log/dragonturtle.log to /var/log/dragonturtle.log.1
  • Logrotate truncates /var/log/dragonturtle.log
  • Process continues to write to /var/log/dragonturtle.log

/etc/logrotate.d/dragonturtle:

/var/log/dragonturtle.log {
    daily
    missingok
    rotate 7
    compress
    delaycompress
    notifempty
    create 644 dragonturtle dragonturtle
}
DanielGibbs
  • 475
  • 2
  • 5
  • 13

2 Answers2

23

The logrotate option that does what you describe is copytruncate. Simply add this option to your existing logrotate config. Here is the excerpt from the logrotate.conf manual: 

   copytruncate
          Truncate  the  original log file in place after creating a copy,
          instead of moving the old log file and optionally creating a new
          one,  It  can be used when some program can not be told to close
          its logfile and thus might continue writing (appending)  to  the
          previous log file forever.  Note that there is a very small time
          slice between copying the file and truncating it, so  some  log-
          ging  data  might be lost.  When this option is used, the create
          option will have no effect, as the old log file stays in  place.
jordanm
  • 41,988
  • 9
  • 116
  • 113
  • I was going to suggest something way more complicated involving inode checks and forked processes, but this is WAY simpler. – Jeight Aug 01 '14 at 22:43
  • It is simpler but you can lose some data. Any alternative that guarantees no data is lost? – Guido May 03 '23 at 12:23
  • @Guido Instead of logging to a file you could have the program log directly TCP to a logging daemon like fluentd or logstash which can handle indexing/rotation itself. I don't think there are other options with just logrotate. – jordanm May 03 '23 at 14:57
  • Thanks @jordanm. Logging to a TCP endpoint is a good idea to avoid logrotate. However, we use the file as a buffer to increase our resilience when the network is down. The alternative you propose would also lose data in that case. – Guido May 17 '23 at 11:08
  • @Guido You can log to local fluentd daemon which has support for file buffering. – jordanm May 17 '23 at 16:16
0

Please note that while using copytruncate option to your logrotate conf file, one might lose some log lines as there is a small time delay involved in truncating the old file and telling the process to write to the same file. It is not suitable for some applications which writes logs for every other milliseconds.

vatsa287
  • 1