On Vi, 13 dec 19, 15:51:32, mj wrote:
>
> And what I do:
> - service rsyslog stop
> - rm -f /usr/local/pf/logs/*
> - ls /usr/local/pf/logs/ to confirm that it *is* empty
> - service rsyslog start
>
> and then all logfiles have reappeared (are regenerated?) in
> /usr/local/pf/conf with timestamp NOW, filled with entries dating back to
> dec 6.
>
> This is debian 9.11. Any other info that is required.?
It's possible rsyslog or something else is keeping the files open. I
would suggest to:
1. Ensure rsyslog is really stopped:
a. If you have systemd check if there is also a .socket unit that
must be stopped.
b. Use 'ps' or similar to check for other instances or rsyslog.
2. Check if something else is keeping the files open, e.g. with 'lsof'
Hope this helps,
Andrei
--
http://wiki.debian.org/FAQsFromDebianUser
Attachment:
signature.asc
Description: PGP signature