Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I am trying to create a separate log file for a application in Linux. So far I have created a .conf script to separate log in custom log file based on program name and it's working correctly.

But, I want to limit the size of log file at 10K and I am using $outchannel for this purpose. The script is stored as /etc/rsyslog.d/00-abc_log.conf:

$outchannel o_abc, /var/log/abc.log, 10240, /home/xyz/logrot
if $programname == 'abc' then :omfile:$o_abc

and script /home/xyz/logrot contains the following:

mv -f /var/log/abc.log /var/log/abc.log.1

Below the 10K limit the logging is working correctly, but after log exceeds 10K size limit, file abc.log.1 doesn't generated and logging in abc.log stops.

If it matters, my system is Xubuntu 12.04 running rsyslog-5.8.6.

Thanks in advance.

share|improve this question
Any reason for not using logrotate and rather writing your own implementation of log rotation? –  gertvdijk Dec 17 '12 at 13:10
Please do not crosspost serverfault.com/questions/458681/… –  gertvdijk Dec 17 '12 at 13:13
@gertvdik - sorry, i will not repeat my mistake. yes, logrotate also works but, it runs on hourly/daily/weekly basis. i am logging file read/write operations so, the log becomes very huge in few minutes. so i want to fix size of log use it like FIFO buffer. –  Jaydeep Dhrangdhariya Dec 18 '12 at 5:17
Logrotate runs on demand too. Just don't put a config file in /etc/logrotate.d/ but specify a path yourself to your own config file. Anyway, I suspect your original problem occurs because your application still has a file descriptor open to the other file. Just use Logrotate with its copytruncate option to not move the file, but rather copy-and-truncate it. –  gertvdijk Dec 18 '12 at 8:55
add comment

1 Answer

Your problem occurs because the application still has the file descriptor open after you moved it on the filesystem. Unless you can tell the program to restart logging directly after moving (usually for deamons, there's a signal for it like SIGHUP), you will have to use another method for rotation than moving files around to which are written into at that time

I suggest to use logrotate like the following. Haven't tested it, as you haven't shared the application involved.

Create your own logrotate configuration file, e.g. abclogrotate.conf:

/var/log/abc.log {
    # don't use time based rotation, but size-based
    size 10k
    # don't move, but copy-and-truncate so the application won't have to be
    # told that the file has moved.
    # maximum of one old file
    rotate 1
    # counting old files starts at 1 rather than 0
    start 1
    # don't use compression

Now call logrotate like this: logrotate /path/to/abclogrotate.conf rather than your own script.

share|improve this answer
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.