Archiving a log file

Dan Nelson dnelson at
Sat Aug 3 23:27:47 UTC 2013

In the last episode (Aug 04), Frank Leonhardt said:
> The answer isn't (AFAIK) newsyslog
> As a one-off, I need to archive an old log file - say httpd-access.log -
> while its still open.  I don't want this to happen automatically and I
> don't want to set up newsyslog or anything like that.  And I really don't
> want to mess about with signals to whatever is writing to the file, even
> assuming the writer could respond to them.  I can't just rename the file
> as it's open for writing, and there would also be a good chance that
> something will be added to the file while it's being compressed.
> What I actually do is:
> cp httpd-access.log httpd-access.log-03-Aug-13 && :> httpd-access.log &&  bzip2 httpd-access.log-03-Aug-13
> Data might be lost here as something may be added between the cp being
> completed and the file being truncated.  It's not the end of the world if
> this happens, but is there a better way?  I could always shut down Apache
> for the duration, but I don't want to do that either, so in this case I'm
> happy to take the risk (it's not like I'm likely to miss anything that
> important).
> I don't know if this can be relied on as a POSIX thing, but the cp command
> simply(!) issues read() and write() calls until read() fails to get any
> more bytes, so if data is being appended to the file after cp is started
> it'll still be copied.  Therefore the window where stuff could be written
> after the copy but before the truncation is shortened, but extant.
> So what's the magic utility I don't know about?

newsyslog :)   It renames the active logfile to a new name, sends the
process a signal (syslog and SIGHUP by default) letting it know that it
should close and reopen its logfile (creating a new one), then gzips the
renamed file.  In Apache's case, just specify the path to apache's pidfile
in your newsyslog.conf, and everything should just work.  

Don't be afraid of signals.  Without signalling the logging process to
switch to a new logfile, and without suspending the process while you do
your copy, there's always going to be a window where you risk losing logged

	Dan Nelson
	dnelson at

More information about the freebsd-questions mailing list