Ever Growing Log Files

[John Stafford]

Beware of using tail to get the end of a log file and then mv to move
the end back to the original.  Some log files are never closed by their
owner, /usr/lib/cron/log being the most notorious.  Hence

   tail -100 /usr/lib/cron/log >/usr/lib/cron/log.temp
   mv /usr/lib/cron/log.temp /usr/lib/cron/log

is a disaster in the making.  The mv dutifully unlinks the old
/usr/lib/cron/log, but it is still open, so the directory entry
disappears, but the file doesn't.  The mv then creates a new
/usr/lib/cron/log that cron knows nothing about (until a reboot/cron
restart).  So after a while you notice that the tail end that you
"saved" is the only content of /usr/lib/cron/log and that it isn't
growing, but your file system is mysteriously getting full (as cron
dutifully continues to write to the unlinked original /usr/lib/cron/log).

If you want to keep a chunk, I prefer to keep it in a separate file,
something like:

   tail -100 /usr/lib/cron/log >/usr/lib/cron/log.old
   cp /dev/null /usr/lib/cron/log

If you really want to keep a chunk in the old file, it gets tricky

   tail -100 /usr/lib/cron/log >/usr/lib/cron/log.temp
   cp /usr/lib/cron/log.temp /usr/lib/cron/log
   rm /usr/lib/cron/log.temp

may or may not work (I've never tried it, so I don't know).  If cron
opens /usr/lib/cron/log with O_APPEND, it will work, if it doesn't, the
results will likely be other than expected (and are beyond the scope of
this course).