Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

The man page of logrotate says that:

It can be used when some program cannot be told to close its logfile
and  thus  might  continue writing to the previous log file for some
time.

I'm confused by this. If a program cannot be told to close its logfile, it will continue to write forever, not for sometime. If the compression is postponed to next rotation cycle, the program continues to write to that file even after the next rotation cycle. How is postponing solving the problem?

My understanding is that copytruncate should be used when a program cannot be told to close the logfile. I'm aware that some data written to the logfile gets lost when the copy is in progress.

I was looking at the logrotate file for couchdb, and it had both copytruncate and delaycompress options.

/usr/local/couchdb-1.0.1/var/log/couchdb/*.log {
   weekly
   rotate 10
   copytruncate
   delaycompress
   compress
   notifempty
   missingok
}

It looks like there is no point using delaycompress when copytruncate is already there. What am I missing?

share|improve this question

2 Answers 2

up vote 8 down vote accepted

Your understanding of copytruncate is correct, but the wording in the manpage for delaycompress is a little misleading. More properly, it should say "when some program cannot be told to immediately close it's logfile" -- for instance, if you're using sharedscripts and the script sends a signal to the process using the log when all the log files have been rotated.

share|improve this answer
    
When I'm using copytruncate, there is no need to tell the program to close it's logfile. So is it meaningless to specify delaycompress along with copytruncate? –  Anand Chitipothu Jul 21 '11 at 6:31
1  
Never use copytruncate unless you absolutely have to, because it loses log entries. You can use both options if you want the other feature that delaycompress provides -- the ability to read the previous logfile without needing to decompress it first. –  womble Jul 21 '11 at 7:08
    
Is there any option other than copytruncate if I can't tell my program to reload? –  Anand Chitipothu Jul 25 '11 at 4:33
3  
No. It's why you should use software that doesn't suck, and which will accept a signal to say "reload your logs". –  womble Jul 25 '11 at 5:26

Not sure if I completely understand your question, but if you're asking what I think...I use this:

postrotate
          killall -HUP syslog-ng
  endscript

That's a nice (or at least a) way to kill the log and move to the next. For "programs" that suck, such as Cisco's ASA platform that log tons of data per second, it works.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.