delete content(truncate) of a log file in use

m4rtin · 02-26-2013, 05:43 PM

I have a 142MiB log file named c3600_router_log.txt under /tmp directory which is used by a process with PID 12369(Dynamips):

Code:

root@potato:/tmp# lsof | grep c3600_router_log.txt
dynamips  12369        root   15w      REG                8,8  199015029         76 /tmp/c3600_router_log.txt
root@potato:/tmp#

I would like to delete the content of this log file. If I do "> c3600_router_log.txt", then file is not truncated:

Code:

root@potato:/tmp# date "+%T"; ls -lh c3600_router_log.txt
02:42:22
-rw-r--r-- 1 root root 190M 27. veebr 02:42 c3600_router_log.txt
root@potato:/tmp# date "+%T"; > c3600_router_log.txt
02:42:24
root@potato:/tmp# date "+%T"; ls -lh c3600_router_log.txt
02:42:25
-rw-r--r-- 1 root root 190M 27. veebr 02:42 c3600_router_log.txt
root@potato:/tmp#

Just to be very sure that file is not rewritten to disk, I ran iotop -b -d 0.5 -p 12369 during flushing the content of /tmp/c3600_router_log.txt, but there was nearly no I/O usage.

How to explain this behavior? Are there situations where one is not able to flush the content of the file which in use by a process?

Kustom42 · 02-26-2013, 05:54 PM

It could have a file lock but you should see that as an error.

Try doing an echo "" > /tmp/c3600_router_log.txt and see if any error is reported.

unSpawn · 02-26-2013, 09:00 PM

Quote:

Originally Posted by m4rtin

How to explain this behavior?

The file is held open on the /proc/12369/15 file descriptor. If the process understands SIGHUP then clean the log and send the signal if it doesn't you have the choice of restarting the process or swapping files on the file descriptor (http://users.linpro.no/ingvar/fdswap.sh.txt).

m4rtin · 02-27-2013, 04:24 AM

Quote:

Originally Posted by Kustom42

It could have a file lock but you should see that as an error.

Try doing an echo "" > /tmp/c3600_router_log.txt and see if any error is reported.

Unfortunately this has exactly the same affect as "> c3600_router_log.txt", "cat /dev/null > c3600_router_log.txt" or ">| c3600_router_log.txt".

Quote:

Originally Posted by unSpawn

The file is held open on the /proc/12369/15 file descriptor.

Yes.

Quote:

Originally Posted by unSpawn

If the process understands SIGHUP then clean the log and send the signal if it doesn't you have the choice of restarting the process or swapping files on the file descriptor (http://users.linpro.no/ingvar/fdswap.sh.txt).

How can I tell if process understands SIGHUP signal? Should I just try "kill -s SIGHUP 12369"? In addition, what is the association between SIGHUP signal and log-file not being truncated?

unSpawn · 02-27-2013, 07:03 AM

Quote:

Originally Posted by m4rtin

How can I tell if process understands SIGHUP signal?

Generally speaking its manual page or documentation will tell you. As an example see your systems syslogd man page.

Quote:

Originally Posted by m4rtin

In addition, what is the association between SIGHUP signal and log-file not being truncated?

Generally speaking processes accepting that signal close open file descriptors, re-read their configuration files and open file descriptors. Common usage for that is rotating log files.

*Apart from using http://users.linpro.no/ingvar/fdswap.sh.txt, depending on what logging you actually need to see, you may also choose to configure your 3600 to log to a remote syslog server.