3

Just discovered that logrotate is not rotating our firewall log. So it's up to 12G in size.

I need to split up the file into smaller chunks and start manually rotating them so I can get things back on track.

However before I start splitting the firewall up, I need to stop the firewall from logging to the current firewall log file and force it to start logging to a new empty file. This way I'm not trying to split up or rotate a log file that is still constantly growing.

I tried to simply do this:

mv firewall firewall.old
touch firewall

I expected to see the new empty firewall file to start growing in size, but no... the firewall.old is still be logged to.

Then I tried to start/stop iptables. No change. firewall.old is still the log file.

I tried to move it to another directory. That didn't help.

I tried to stop iptables, then change the filename and create a new firewall file and then start iptables again, but no change.

How do I stop the logging on this file and force it to start logging on a new file?

4 Answers 4

6

iptables uses the syslog facility for logging. Send a SIGHUP to syslogd, ksyslogd, or rsyslogd to close and reopen the log files.

1
  • Thanks for the simple solution. I renamed my firewall log, then kill -HUP 1660 (1660 = pid of rsyslogd), and then it started writing a new firewall log. Apr 12, 2010 at 17:25
3

The writing of the log file is not performed by iptables. iptables simply logs to the kernel syslog facility and it's up to your syslog program to write it to a log file. When you are moving the file, you're essentially just renaming it from the filesystem perspective. Your syslog daemon has no idea that you did this and happily keeps writing to its opened filehandle. What you need to do is reload your syslog daemon so that it reopens the file based on its filesystem path and starts writing to the new file. Most syslog daemons support catching the HUP signal to do this and don't require a full restart.

You should use a program such as logrotate, which is preinstalled with most distros, to handle the rotation for you. It's smart about it and supports actions such as signalling daemons. You don't need to roll your own script for this purpose.

1
  • I'm not trying to roll my own. You misread. Apr 12, 2010 at 17:22
2

Your config files for logrotate should include a postrotate section that reloads or SIGHUPs syslog or rsyslog or equivalent.

On my system, /etc/logrotate.d/rsyslog contains, among other things:

    postrotate
            reload rsyslog >/dev/null 2>&1 || true
    endscript
3
  • how does this help me? Apr 12, 2010 at 17:23
  • 1
    @Jakobud: You should check your configuration. It should take care of notifying syslog that it needs to switch to the new log files after they've been rotated. It should do this automatically without you needing to intervene. My answer is an attempt to lead you toward a long-term solution. Apr 12, 2010 at 17:46
  • @Jakobud : Your problem is a common one. Dennis' solution is shows the common solution to your problem. This configuration should normally be in place but on your system, the configuration may have been deleted. This would have prevented your 12GB logfile in the first place. Iptables logs to syslog, and log-rotation is handled by logrotate. After the log rotation, Logrotate will send a reload/HUP signal to syslog, and logdata will now be written to the newly created logfiles. I also highly recommend the 'compress' option, and make sure you don't rotate those logfiles out of existence. Apr 26, 2010 at 19:57
-2

You can make a copy of your syslog file:

cp -abf sys.log sys.log_bak

And move the copy to any desired location:

mv sys.log_bak /path/desired/sys.log_bak

And clear the contents of the original file:

cat /dev/null > sys.log

Your original file will continue to receive syslogs thereafter; you don't have to swap it with another file.

1
  • 2
    This doesn't actually answer the question and will lose log entries.
    – MikeyB
    Sep 30, 2012 at 18:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .