Re: savelog can lose data

[Guy Maor <maor@debian.org>]

Neil Schemenauer <nascheme@ucalgary.ca> writes:

> There is a problem with savelog.  The current log file should not
> be moved.  Compressing it removes the original file.  If a
> program holds this file open and writes to it after it is removed
> then that data is lost.

Yes, savelog does assume that programs periodically reopen their log
files.  The first rotation of the logfile from log to log.0 is safe,
but the second rotation from log.0 to log.1.gz is not.  This is even
documented in the BUGS section of manpage.

If you are worried, the simple solution is to not gzip files.  Call it
with the -l flag.  Data could then be lost when the final log is
deleted, log.<cycle-1>.  Daemons are expected to reopen their log
files once a day or so.


Guy