Archiving a log file

Frank Leonhardt freebsd-doc at
Sat Aug 3 23:11:30 UTC 2013

The answer isn't (AFAIK) newsyslog

As a one-off, I need to archive an old log file - say httpd-access.log - 
while its still open. I don't want this to happen automatically and I 
don't want to set up newsyslog or anything like that. And I really don't 
want to mess about with signals to whatever is writing to the file, even 
assuming the writer could respond to them. I can't just rename the file 
as it's open for writing, and there would also be a good chance that 
something will be added to the file while it's being compressed.

What I actually do is:

cp httpd-access.log httpd-access.log-03-Aug-13 && :> httpd-access.log && 
bzip2 httpd-access.log-03-Aug-13

Data might be lost here as something may be added between the cp being 
completed and the file being truncated. It's not the end of the world if 
this happens, but is there a better way? I could always shut down Apache 
for the duration, but I don't want to do that either, so in this case 
I'm happy to take the risk (it's not like I'm likely to miss anything 
that important).

I don't know if this can be relied on as a POSIX thing, but the cp 
command simply(!) issues read() and write() calls until read() fails to 
get any more bytes, so if data is being appended to the file after cp is 
started it'll still be copied. Therefore the window where stuff could be 
written after the copy but before the truncation is shortened, but extant.

So what's the magic utility I don't know about?

Thanks, Frank.

More information about the freebsd-questions mailing list