Re: rolling over high-traffic logfiles?

[Brian Harvell <harvell@aol.net>]

> 
> } does anyone have any other ideas on how to not lose and log entires?
> 
> Use "ln" and "mv" to replace the file, rather than "cp" over it.
> 
> 	cp /dev/null extlog.new &&
> 	ln extlog extlog.`date` &&
> 	mv -f extlog.new extlog ||
> 	rm -f extlog.new
> 
> There's still a race condition where some process could attempt to write
> to extlog during the execution of "mv", that is, between unlinking the
> old extlog and renaming extlog.new to extlog.  However, the window for
> failure is much smaller, and could be made smaller still by using the
> "files" module with zsh 3.1.4 so that "ln" and "mv" are shell builtins.
> 

That won't work. You are going to have to send syslog a sighup before it
will release it's current file handle and reopen to a new one.

All you need to do is
mv the logfile to the new name. (syslog will continue to write to it even
after the mv has completed)
then send syslog a sighup. (It will then open a new log file)

There is still a small chance that you will loose entries but that's the nature
of syslog anyway. Syslogd can easily get overloaded and drop entries on the
floor.

Brian

Brian Harvell         harvell@aol.net         http://boondoggle.web.aol.com/
echo '[q]sa[ln0=aln256%Pln256/snlbx]sb3135071790101768542287578439snlbxq'|dc