From owner-freebsd-questions@FreeBSD.ORG Sat Aug 3 23:27:47 2013 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTP id 4A7AA703 for ; Sat, 3 Aug 2013 23:27:47 +0000 (UTC) (envelope-from dan@dan.emsphone.com) Received: from email2.allantgroup.com (email2.emsphone.com [199.67.51.116]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 0C566217B for ; Sat, 3 Aug 2013 23:27:46 +0000 (UTC) Received: from dan.emsphone.com (dan.emsphone.com [172.17.17.101]) by email2.allantgroup.com (8.14.5/8.14.5) with ESMTP id r73NRZdn039975 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Sat, 3 Aug 2013 18:27:35 -0500 (CDT) (envelope-from dan@dan.emsphone.com) Received: from dan.emsphone.com (smmsp@localhost [127.0.0.1]) by dan.emsphone.com (8.14.7/8.14.6) with ESMTP id r73NRZHV072618 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Sat, 3 Aug 2013 18:27:35 -0500 (CDT) (envelope-from dan@dan.emsphone.com) Received: (from dan@localhost) by dan.emsphone.com (8.14.7/8.14.7/Submit) id r73NRZMt072617; Sat, 3 Aug 2013 18:27:35 -0500 (CDT) (envelope-from dan) Date: Sat, 3 Aug 2013 18:27:35 -0500 From: Dan Nelson To: Frank Leonhardt Subject: Re: Archiving a log file Message-ID: <20130803232735.GC47411@dan.emsphone.com> References: <51FD8E19.90403@fjl.co.uk> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <51FD8E19.90403@fjl.co.uk> X-OS: FreeBSD 9.1-STABLE User-Agent: Mutt/1.5.21 (2010-09-15) X-Virus-Scanned: clamav-milter 0.97.8 at email2.allantgroup.com X-Virus-Status: Clean X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.2.7 (email2.allantgroup.com [172.17.19.78]); Sat, 03 Aug 2013 18:27:35 -0500 (CDT) X-Spam-Status: No, score=-3.9 required=5.0 tests=ALL_TRUSTED,BAYES_00, RP_MATCHES_RCVD autolearn=ham version=3.3.2 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on email2.allantgroup.com X-Scanned-By: MIMEDefang 2.73 Cc: freebsd-questions@freebsd.org X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 03 Aug 2013 23:27:47 -0000 In the last episode (Aug 04), Frank Leonhardt said: > The answer isn't (AFAIK) newsyslog > > As a one-off, I need to archive an old log file - say httpd-access.log - > while its still open. I don't want this to happen automatically and I > don't want to set up newsyslog or anything like that. And I really don't > want to mess about with signals to whatever is writing to the file, even > assuming the writer could respond to them. I can't just rename the file > as it's open for writing, and there would also be a good chance that > something will be added to the file while it's being compressed. > > What I actually do is: > > cp httpd-access.log httpd-access.log-03-Aug-13 && :> httpd-access.log && bzip2 httpd-access.log-03-Aug-13 > > Data might be lost here as something may be added between the cp being > completed and the file being truncated. It's not the end of the world if > this happens, but is there a better way? I could always shut down Apache > for the duration, but I don't want to do that either, so in this case I'm > happy to take the risk (it's not like I'm likely to miss anything that > important). > > I don't know if this can be relied on as a POSIX thing, but the cp command > simply(!) issues read() and write() calls until read() fails to get any > more bytes, so if data is being appended to the file after cp is started > it'll still be copied. Therefore the window where stuff could be written > after the copy but before the truncation is shortened, but extant. > > So what's the magic utility I don't know about? newsyslog :) It renames the active logfile to a new name, sends the process a signal (syslog and SIGHUP by default) letting it know that it should close and reopen its logfile (creating a new one), then gzips the renamed file. In Apache's case, just specify the path to apache's pidfile in your newsyslog.conf, and everything should just work. Don't be afraid of signals. Without signalling the logging process to switch to a new logfile, and without suspending the process while you do your copy, there's always going to be a window where you risk losing logged data. -- Dan Nelson dnelson@allantgroup.com