Understanding logrotate's create directive

Question

There is a web application (php/apache2) which opens a log file somewhere at a start of a request handling and closes it (as far as I know) when the handling is finished. Between log file open and close, entries are of course written.

Let's assume that somewhere in a middle of a request handling (i.e. some log entries were already written and some were not yet written) log rotation using logrotate is performed and its configuration is like following:

/var/log/some/path/*.log {
  weekly
  missingok
  rotate 30
  compress
  delaycompress
  notifempty
  create <mode> <owner> <group>
  size 10M
}

If I understand the logrotate man page, the create directive will cause the current log file (the file which is open by the request handling being in progress) to be renamed/moved and a new, empty log file to be created. If so, then what will happen to not yet written log entries generated by the request handling in progress? Will they be appended to the renamed/moved file or maybe they will be lost? The second question is about the postrotate and or prerotate directives. Do I need them in my case? The only thing I can think about to put in them is an apache graceful restart command but do I actually need it?

score 2 · Accepted Answer · answered Jul 22 '11 at 13:52

The answer is that apache doesn't open and close the file every time it appends to it, since it would be a huge amount of filesystem overhead. It opens a file handle on the log file at startup and keeps it open indefinitely.

Note that the create directive isn't the thing that creates the new file, that just defines the owner and mode that the new file is given when rotation occurs.

When apache writes to a log file, it writes to the open file handle. This handle should still be attached to the existing file, even though the name of that file may have changed in the mean time. This is the reason the original apache logrotate config contains a block like this:

postrotate
        if [ -f "`. /etc/apache2/envvars ; echo ${APACHE_PID_FILE:-/var/run/apache2.pid}`" ]; then
                /etc/init.d/apache2 reload > /dev/null
        fi
endscript

That one's from Debian. Others may do it differently, but the effect is to cause apache to reload its configuration, thus making it re-open its file handles on named log files. Since logrotate has just created a new, empty log file with that name, apache will start writing to it.

So, no log entries are lost, but this form of rotation does necessitate a regular reload via the postrotate directive. People with very high traffic servers don't tend to like this restraint and might favour some other logging method such as mod_log_spread

The application I am working with is writing logs to its own files operated by Zend Framework's logging utils, which in turn close log file(s) after each request (I verified it both by code analysis and little experiment). It seems that in such configuration it doesn't need the `postrotate` directive. I understand things better now, thank you for your help :) — Dariusz Walczak, Jul 25 '11 at 11:55

Understanding logrotate's create directive

1 Answers1