On 19.01.2022 17:43, Helmut Schneider via rsyslog wrote:
Am 19.01.2022 um 13:21 schrieb Mariusz Kruk via rsyslog:
On 19.01.2022 13:10, Helmut Schneider via rsyslog wrote:
Am 19.01.2022 um 12:11 schrieb Mariusz Kruk via rsyslog:
It's not exactly clear what you mean :-)
[...]
3. logrotate sends SIGHUP to rsyslogd as part of postrotate action
If logrotate rotes a log, do I always have to reload rsyslod or only
under some circumstances?
Well, you never "have to" ;-)
But seriously. As I wrote before - when you rotate the file, logrotate
does a simple syscall changing the link in the directory index but the
file itself (inode, contents) stays the same. And if it's open at time
of rotating the descriptors stay open and the processes that have the
file open still work on the file they had opened at the moment of
rotation. But if any process wants to open the file by the old name - it
won't find it because file _under that name_ is no longer present in the
directory. So if "old" process doesn't close/re-open the file, it will
still be writing to the old file under a new name when newly created
processes (or old processes which open the file later) will refer to a
new file.
Sounds to me like "killall -HUP rsyslogd" is recommended on each run
of logrotate, correct? At least it doesn't hurt. :)
It's actually necessary for quite a significant subset of daemons. It's
quite typical for well-written daemons to close/reopen their log files
in response to SIGHUP. And you do it in postrotate action in logrotate
quite often.
The more problematic ones are those that don't do it (like tomcat which
- at least some time ago when I worked with it - could "rotate" files
meaning it would create new files on its own in some conditions but it
could not limit the number of files and delete oldest ones) and need
full restart to actually close/open log files (and such restart of
course can be time consuming and introduces significant downtime to the
service).
But that's completely different story (not related to rsyslog itself).
_______________________________________________
rsyslog mailing list
https://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
