Logrotate copytruncate alternative

bujecas · 09-25-2008, 06:35 AM

Hello,

I have a Syslog-NG server write to some log files and a program (SEC) reading from them. The SEC needs to have the same file opened, so I was using the copytruncate in the logrotate of the log files. My problem is that I'm losing some log entries during the rotation.

Here's my logrotate configuration file:

Code:

/srv/syslog/pulso/*.log {
        rotate 2
        copytruncate
        compress
        ifempty
        missingok
        lastaction
                find /srv/syslog/pulso/*.log.{1,2}.gz 2>/dev/null |while read f; do
                        DATA=`date +%Y-%m-%d`
                        HORA=`date +%H`
                        HORA=`expr $HORA - 1`
                        [ "$HORA" == "-1" ] && HORA=23
                        HORA=`printf "%02d" $HORA`

                        new_filename=`echo $f |sed 's/\.[12]\.gz//'`
                        mv $f $new_filename.${DATA}_${HORA}.gz
                done
        endscript
}

There's any alternative to copytruncate without losing events? The lastaction that I have, could slow down the process?

Thanks.

unSpawn · 09-28-2008, 04:14 AM

Quote:

Originally Posted by bujecas

There's any alternative to copytruncate without losing events?

I don't know if it's possible for you but SEC can read from named pipes. You could 'mkfifo' one and let SEC read from there during this logrotate?

Quote:

Originally Posted by bujecas

The lastaction that I have, could slow down the process?

Slow down yes, effect on "copytruncate" no (I would think). You could avoid worrying about it by for example moving the postrotate script to a script file and let 'at' handle it ('at -f /some/script now'). Handing it off that way frees logrotate to move on to the next logrotate action.