Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Just discovered that logrotate is not rotating our firewall log. So it's up to 12G in size.

I need to split up the file into smaller chunks and start manually rotating them so I can get things back on track.

However before I start splitting the firewall up, I need to stop the firewall from logging to the current firewall log file and force it to start logging to a new empty file. This way I'm not trying to split up or rotate a log file that is still constantly growing.

I tried to simply do this:

mv firewall firewall.old
touch firewall

I expected to see the new empty firewall file to start growing in size, but no... the firewall.old is still be logged to.

Then I tried to start/stop iptables. No change. firewall.old is still the log file.

I tried to move it to another directory. That didn't help.

I tried to stop iptables, then change the filename and create a new firewall file and then start iptables again, but no change.

How do I stop the logging on this file and force it to start logging on a new file?

share|improve this question
add comment

4 Answers

up vote 4 down vote accepted

iptables uses the syslog facility for logging. Send a SIGHUP to syslogd, ksyslogd, or rsyslogd to close and reopen the log files.

share|improve this answer
    
Thanks for the simple solution. I renamed my firewall log, then kill -HUP 1660 (1660 = pid of rsyslogd), and then it started writing a new firewall log. –  Jakobud Apr 12 '10 at 17:25
add comment

The writing of the log file is not performed by iptables. iptables simply logs to the kernel syslog facility and it's up to your syslog program to write it to a log file. When you are moving the file, you're essentially just renaming it from the filesystem perspective. Your syslog daemon has no idea that you did this and happily keeps writing to its opened filehandle. What you need to do is reload your syslog daemon so that it reopens the file based on its filesystem path and starts writing to the new file. Most syslog daemons support catching the HUP signal to do this and don't require a full restart.

You should use a program such as logrotate, which is preinstalled with most distros, to handle the rotation for you. It's smart about it and supports actions such as signalling daemons. You don't need to roll your own script for this purpose.

share|improve this answer
    
I'm not trying to roll my own. You misread. –  Jakobud Apr 12 '10 at 17:22
add comment

Your config files for logrotate should include a postrotate section that reloads or SIGHUPs syslog or rsyslog or equivalent.

On my system, /etc/logrotate.d/rsyslog contains, among other things:

    postrotate
            reload rsyslog >/dev/null 2>&1 || true
    endscript
share|improve this answer
    
how does this help me? –  Jakobud Apr 12 '10 at 17:23
1  
@Jakobud: You should check your configuration. It should take care of notifying syslog that it needs to switch to the new log files after they've been rotated. It should do this automatically without you needing to intervene. My answer is an attempt to lead you toward a long-term solution. –  Dennis Williamson Apr 12 '10 at 17:46
    
@Jakobud : Your problem is a common one. Dennis' solution is shows the common solution to your problem. This configuration should normally be in place but on your system, the configuration may have been deleted. This would have prevented your 12GB logfile in the first place. Iptables logs to syslog, and log-rotation is handled by logrotate. After the log rotation, Logrotate will send a reload/HUP signal to syslog, and logdata will now be written to the newly created logfiles. I also highly recommend the 'compress' option, and make sure you don't rotate those logfiles out of existence. –  Stefan Lasiewski Apr 26 '10 at 19:57
add comment

You can make a copy of your syslog file:

cp -abf sys.log sys.log_bak

And move the copy to any desired location:

mv sys.log_bak /path/desired/sys.log_bak

And clear the contents of the original file:

cat /dev/null > sys.log

Your original file will continue to receive syslogs thereafter; you don't have to swap it with another file.

share|improve this answer
1  
This doesn't actually answer the question and will lose log entries. –  MikeyB Sep 30 '12 at 18:57
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.