7

In the case that logrotate runs the same time as the log file is being updated, what will happen? Will the new log be rotated into a historical log file? Or it will stay in the current log file?

chicks
  • 3,793
  • 10
  • 27
  • 36
johnsam
  • 235
  • 1
  • 6

1 Answers1

14

During a rotation log messages can end up in either the old or the new file, but in a deterministic way. Logrotate does roughly the following for each logfile:

  1. Rename the log to the archived name
  2. Signal the application to reopen its logs
  3. Optionally compress the logfile

If messages get logged between 1 and 2, these will end up in the renamed log, because a rename does not affect open file descriptors (this is also why compression only happens after applications reopen their logs). Messages logged after 2 will end up in the new log.

Here's an excerpt from my logrotate config that does what I described for nginx' logs:

/var/log/nginx/*.log {
    compress
    delaycompress
    postrotate
        [ ! -f /run/nginx.pid ] || kill -USR1 `cat /run/nginx.pid`
    endscript
}
Dennis Kaarsemaker
  • 19,277
  • 2
  • 44
  • 70
  • This is also why logrotate has a `delaycompress` option -- to allow for processes to finish writing to the log before it compresses the old file and deletes it (which would cause any further writes to go to an open file handle with no link to the filesystem , losing those messages). – voretaq7 Nov 11 '13 at 21:20
  • Does logrotate always signal the application to reopen its logs? Does the application always handles signal properly? –  Nov 11 '13 at 21:21
  • It has to be configured to do so, I'll add an example. – Dennis Kaarsemaker Nov 11 '13 at 21:23
  • Is there any way to rotate the log file on a daily basis but delay the rotate for 24 hours? Such as only rotate messages that are older than 24 hours and keep the messages that are newer than 24 hours. – johnsam Nov 11 '13 at 21:36
  • No, that is not possible. – Dennis Kaarsemaker Nov 11 '13 at 21:41
  • Is there an official doc where this behavior of logrotate is described? – yuranos Aug 14 '17 at 17:26