Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I wrote a small c app that uses the syslog c interface to write messages (from man 3 syslog):

void openlog(const char *ident, int logopt, int facility);
void syslog(int priority, const char *message, ...);
void closelog(void);

My question: I'm writing messages to LOCAL0 in /var/log/local0.log. I also have cron calling logrotate on /var/log/local0.log. I've noticed that after the rotation, my app continues writing to the file that was rotated out instead of the new /var/log/local0.log.

What is the best way to fix this with a postrotate script?

  1. Easy, but not ideal: completely restart the rsyslog daemon.

  2. Send and handle SIGHUP in my app. This seems like the most appropriate solution. But I'm not sure what I need to do when I get the HUP. Do I just need to call closelog() then openlog()?

share|improve this question

migrated from Jan 23 '10 at 0:25

This question came from our site for professional and enthusiast programmers.

Send the SIGHUP to syslogd, not your program.

share|improve this answer
Hmm, i'm doing this and it doesn't seem to work: /var/log/local0.log { create size 0k notifempty rotate 10 missingok postrotate /usr/bin/killall -HUP rsyslogd endscript nocompress } – rizen Jan 22 '10 at 22:17
@rizen: explanation: your application is not writing to the log, your application is sending your log lines to the syslog daemon. the syslog daemon opens the log and writes to the log, so the syslog daemon is what is keeping the file, so it is the syslog daemon that needs to be told to drop the file and start a new one. Therefore Sean's solution should be the correct one. – Bandi-T Jan 22 '10 at 22:18
size 0k <- that looks wrong to me. – Sean Bright Jan 22 '10 at 22:24
Hmm, ok. it seems to work if I do /etc/init.d/rsyslog restart. but if I do kill -HUP $(cat /var/run/ like the docs say it doesn't seem to work. I'm so baffled – rizen Jan 23 '10 at 0:11

Another decent workaround, which doesn't quite fit your situation but can be used "in a pinch" is the copytruncate option in logrotate. It means whatever is writing to the logfile does not need to be notified.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.