In Log Insight 4.0, several enhancements have been made to the Log Insight agent. Read on to learn more!
The more I use logrotate the less I like it. If you recall from my previous post on logrotate, I choose to leverage the copytruncate option. While this configuration seemed to work well when I tested it, I have now experienced some significant limitations that are not documented in the man page:
- After rotation, high volume logs files remained the same size and continued to grow
- Pre and post rotated high volume log files contained NUL characters
- Large sized log files lost messages during logrotate operation
So what caused the issues, what was the impact, and how can you rotate logs messages and not experience these issues?
I having been working on a syslog architecture and one key component to the architect was leveraging log rotate for all log files. One section of my log rotate file looked like the following:
/usr/sbin/invoke-rc.d syslog-ng reload >/dev/null
The problem was, I noticed that after the cron for logrotate ran the system started to become slow. Looking at top I noticed several things: the load average continued going up, the logrotate process continued to run with the process consuming around 50% of memory, and the syslog process never restarted.
What was causing the problem?