How to reallocate the deleted logfile space

Srinivas Gadi · 12-27-2014, 05:46 AM

Hi There,

I know, this is very simple question , but not able to figure out the perfect answer.

There is a huge log file , if we delete the log file ,how the corresponding occupied file memory relocate to Hard Disk

Thanks
Srinivas

pan64 · 12-27-2014, 05:57 AM

I'm sorry, but do not understand. The file will be removed from the disk, not from the memory (using the command rm)

Srinivas Gadi · 12-27-2014, 06:34 AM

Let me explain you clearly

suppose there is log file : /var/log/messages and it occupies the 1G.
and I just deleted it through rm -f /var/log/messages , and the file is no more in the on disk.
but the occupied memory has not been released.

My question is , How to make use of these space with out system reboot?

Hope I am clear now.

unSpawn · 12-27-2014, 06:44 AM

First of all you should not be deleting log files but using 'logrotate' (see 'man logrotate'). Secondly if you manually delete a log file that's currently being written to it remains opened on the file descriptor of the application. The solution is to restart the service (usually a 'kill -HUP' will do).

jpollard · 12-27-2014, 02:51 PM

Depending on your distribution, I believe that what you actually did was delete an open file.

The space will be reclaimed when the file is closed.

One way of doing that is to restart syslog.

An easier way is to identify the syslogd daemon (ps, it is likely called rsyslogd) and use "kill -1 $(cat /var/run/rsyslogd.pid)".

You can check the rsyslogd manpage for details:

Code:

SIGNALS
       Rsyslogd  reacts  to a set of signals.  You may easily send a signal to
       rsyslogd using the following:

              kill -SIGNAL $(cat /var/run/rsyslogd.pid)

       Note that -SIGNAL must be replaced with the actual signal you are  try‐
       ing to send, e.g. with HUP. So it then becomes:

              kill -HUP $(cat /var/run/rsyslogd.pid)

       HUP    This  lets rsyslogd perform close all open files.  Also, in v3 a
              full restart will be done in order to read changed configuration
              files.   Note  that  this means a full rsyslogd restart is done.
              This has, among others, the consequence that TCP and other  con‐
              nections  are  torn down. Also, if any queues are not running in
              disk assisted mode or are not set to persist data  on  shutdown,
              queue  data  is  lost. HUPing rsyslogd is an extremely expensive
              operation and should only be done when actually necessary. Actu‐
              ally,  it  is a rsyslgod stop immediately followed by a restart.
              Future versions will remove this restart  functionality  of  HUP
              (it  will  go  away in v5). So it is advised to use HUP only for
              closing files, and a  "real  restart"  (e.g.  /etc/rc.d/rsyslogd
              restart) to activate configuration changes.

As stated above, the "logrotate" script will do this for you, and you can use its configuration file to limit the size of log files, having various daemons close their log files as well automatically.

unSpawn · 12-27-2014, 04:12 PM

There's actually no need to "believe" an open file was deleted when one can simply make sure by checking:

Code:

lsof|grep dele

*Bonus points for making lsof quicker and narrowing things down knowing the location where the log file resides:

Code:

lsof -Pln -a +D/var/log|grep dele