Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Has anyone had any issues with logrotate before that causes a log file to get rotated and then go back to the same size it originally was? Here's my findings:

Logrotate Script:

/var/log/mylogfile.log {
    rotate 7
    daily
    compress
    olddir /log_archives
    missingok
    notifempty
    copytruncate
}

Verbose Output of Logrotate:

copying /var/log/mylogfile.log to /log_archives/mylogfile.log.1
truncating /var/log/mylogfile.log
compressing log with: /bin/gzip
removing old log /log_archives/mylogfile.log.8.gz

Log file after truncate happens

[root@server ~]# ls -lh /var/log/mylogfile.log
-rw-rw-r--  1 part1 part1 0 Jan 11 17:32 /var/log/mylogfile.log

Literally Seconds Later:

[root@server ~]# ls -lh /var/log/mylogfile.log
-rw-rw-r--  1 part1 part1 3.5G Jan 11 17:32 /var/log/mylogfile.log

RHEL Version:

[root@server ~]# cat /etc/redhat-release 
Red Hat Enterprise Linux ES release 4 (Nahant Update 4)

Logrotate Version:

[root@DAA21529WWW370 ~]# rpm -qa | grep logrotate
logrotate-3.7.1-10.RHEL4

Few Notes:

  • Service can't be restarted on the fly, so that's why I'm using copytruncate
  • Logs are rotating every night, according to the olddir directory having log files in it from each night.
share|improve this question
add comment

3 Answers

up vote 9 down vote accepted

This is probably because even though you truncate the file, the process writing to the file will continue writing at whichever offset it were at last. So what's happening is that logrotate truncates the file, size is zero, process writes to the file again, continuing at the offset it left off, and you now have a file with NULL-bytes up to the point where you truncated it plus the new entries written to the log.

od -c after truncate + sudden growth, generated output along the lines of:

0000000  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0
*
33255657600  \0   C   K   B   -   s   e   r   v   e   r       [   h   t   t
33255657620 <more log output>

What this says is from offset 0 to 33255657600 your file consists of null bytes, and then some legible data. Getting to this state doesn't take the same amount of time it would take to actually write all those null-bytes. The ext{2,3,4} filesystems support something called sparse files, so if you seek past a region of a file that doesn't contain anything, that region will be assumed to contain null-bytes and won't take up space on disk. Those null bytes won't actually be written, just assumed to be there, hence the time it takes to go to 0 to 3.5GB don't take a lot of time to. (You can test the amount of time it takes by doing something like dd if=${HOME}/.bashrc of=largefile.bin seek=3432343264 bs=1, this should generate a file of over 3GB in a few milliseconds).

If you run ls -ls on your logfiles after they've been truncated and had a sudden growth again, it should now report a number at the beginning of the line which represents the actual size (in blocks occupied on disk), which probably is orders of magnitude smaller than the size reported by just ls -l.

share|improve this answer
    
I don't think so - in seconds, the log file goes from 0 bytes to 3.5GB. The total time it takes for logrotate to complete is about 5 minues. The log files isn't written to that fast AND the size is always the original size, which seems too much coincidental. –  drewrockshard Jan 12 '11 at 0:18
    
There should be an easy way of verifying this, inspect the file and see if there's actually anything in it. Start out by running od -c filename | head -n 100. Chances are it'll tell you in a few lines that there's a truckload of null-bytes, plus the latest log-entries. –  Kjetil Joergensen Jan 12 '11 at 0:35
    
If this is the case then can we test whether cat /dev/null > /var/log/mylogfile.log truncates the file in a way that solves this issue, rather than using logrotate built in copytruncate? –  mtinberg Jan 12 '11 at 0:43
2  
The problem doesn't lie with the way the file is truncated, the problem lies with how the program writes the logfile. For truncating the logfile to be a viable approach, you'll have to get the program writing to the logfile somehow seek to position 0. It's possible that a filesystem that doesn't support sparse files wouldn't have this proble, although I don't have any way of testing that right now. –  Kjetil Joergensen Jan 12 '11 at 1:03
1  
This final answer actually made more sense and the fix will probably end up being to restart the application. –  drewrockshard Jan 12 '11 at 21:27
show 4 more comments

I am extremely confident that Kjetil has hit it. Drew, you may not yet be convinced by his explanation but I urge you to read carefully what he's said.

If you accept it, the fix is either to stop and restart your application when the logs are rotated, or use a tool like apache's "rotatelogs", where you feed the log output to the tool via a pipe, and the tool takes care of rotating the logfile every so often. For example, one of my apache instances logs with

ErrorLog "|/usr/sbin/rotatelogs /www/logs/error_log 604800"

which causes a lot of logfiles with names like

-rw-r--r--    1 root     root         4078 Dec 21 01:04 error_log.1292457600
-rw-r--r--    1 root     root         4472 Dec 29 08:41 error_log.1293062400
-rw-r--r--    1 root     root        78630 Jan  4 12:57 error_log.1293667200
-rw-r--r--    1 root     root        15753 Jan 12 01:10 error_log.1294272000

to appear without restarting apache; I can then compress them manually after the fact. Note how the rotation is done every week, which is every 604800 seconds, that being the argument passed to rotatelogs.

If you can't stop and restart the app, and it can't log via a pipe, then I think you've got a real problem. Perhaps others will have suggestions.

share|improve this answer
add comment

it would be really great if you could send the whole logrotate.

Why try to use kill -HUP ? (Classical reloading not restarting) method.

Also ... check with lsof who is accessing the file.

share|improve this answer
    
Can't use kill -HUP as this application cannot be touched in any way - it's a sensitive application that I do not own (I don't even manage it - I only manage the OS side) so I need to be able to do the logrotations this way. –  drewrockshard Jan 12 '11 at 14:04
1  
Sorry, original message got submitted early, here's the rest of my original message: I logged into the system this morning and the file is now back to normal after the scheduled logrotate in /etc/cron.daily was initiated. Question to all: Is there something that the logrotate script does differently than running logrotate manually? My logrotate script literally looks like /usr/sbin/logrotate /etc/logrotate.conf. This is quite baffling. –  drewrockshard Jan 12 '11 at 14:17
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.