Moving, creating and deleting log files.

NotionCommotion · 05-13-2017, 08:46 AM

I have postfix on Centos 6.

I renamed /etc/log/maillog to /etc/log/maillog.bak.

I restarted postfix thinking I would have a new /etc/log/maillog file.

Nope. Tried touching one, but still didn't get updated.

Then I realized postfix was now using maillog.bak.

How did it know? If I deleted /etc/log/maillog instead of moving it, would postfix have created a new file?

G0kulakrishnan · 05-13-2017, 09:04 AM

It is using the inode not the file name. take the copy of the file and nullify it

NotionCommotion · 05-13-2017, 09:23 AM

Quote:

Originally Posted by G0kulakrishnan

It is using the inode not the file name. take the copy of the file and nullify it

Ah, I see!

By nullify, you mean to empty the log, do > maillog or cat /dev/null > maillog?

If I did actually delete the file, I suspect a new one would have been created. Agree? Afraid to try and break things...

Habitual · 05-13-2017, 10:45 AM

Quote:

Originally Posted by NotionCommotion

Ah, I see!

By nullify, you mean to empty the log, do > maillog or cat /dev/null > maillog?

If I did actually delete the file, I suspect a new one would have been created. Agree? Afraid to try and break things...

I'm fond of

Code:

> /path/to/file

personally, it leaves permissions and such alone, I believe.

logrotate should take care of those also... something to check out.

NotionCommotion · 05-13-2017, 11:51 AM

Thanks Habitual,

How do you do so using sudo?

pan64 · 05-13-2017, 12:30 PM

Quote:

Originally Posted by NotionCommotion

If I did actually delete the file, I suspect a new one would have been created. Agree? Afraid to try and break things...

Not really. Especially the log files are a bit strange from this point of view.
If a file is opened and in use you cannot delete the file, but remove only the directory entry. The processes which opened that file will still keep it and use it (usually these are the logfiles). So you need to reboot or tell the process to drop it.

MadeInGermany · 05-13-2017, 03:56 PM

The maillog is written by syslog; you get its PID with

Code:

fuser /var/log/maillog

After renaming it you must inform syslog. Look how it's done by logrotate

Code:

cat `grep -l /etc/logrotate.d/*`

Habitual · 05-13-2017, 04:35 PM

Quote:

Originally Posted by NotionCommotion

Thanks Habitual,

How do you do so using sudo?

Yes, there are a couple of gotchas in the shell, aren't there?
! in your "password" (another gotcha)
> is potent stuff and combined with sudo privs, Well, I'd have to trash it first hand in a VM,
same as every thing else?

Code:

sudo su -
> /path/to/file && exit;

May have to be utilized, I stay root on lots of hosts daily.

Are you asking how to

Code:

sudo > /path/to/file

If so, No Go, Eskimo, I don't know!
That ">" is a meta-character and it's a monster when it fscks up.
I'd just assume not use sudo "that way".

But that's just me. and you did Ask.

Peace.

NotionCommotion · 05-13-2017, 06:03 PM

Quote:

Originally Posted by Habitual

But that's just me. and you did Ask.

Yes I did!

This also works. Maybe doesn't matter, but I like the idea of not permanently switching to root unless I really want to.

Code:

sudo truncate -s0 yourfile