I support an app that outputs alert and audit messages to one log file (vendor says they can't be separated). The script that I have written takes a copy (mv cmd) of the file to do the separation and reformatting. I have a problem that I loose records (messages are being written constantly, upto 3+ a second) between doing the mv and touch command on the log file. What could I do to stop these records being missed? feed the output straight into a script? Can I name pipes (this should allow for the script to read one message at a time)? any ideas would be great. Easier the better.

Shutdown the app. Save the old log. Restart the app.

Sounds good....I would luv to turn it off and keep it off but it is in a 24x7 app and I would have to turn it off every 10 minutes in order to keep file size down (plus, it takes about 3-5mins to start and stop).

How do you become a UNIX Daemon? Who do I have to fight.....bring it on.

I guess it must be opening the log file in append mode for each write since your move works at all. So maybe you can something like this....

cd /log/directory
kill -STOP $pid
mv log olog
kill -CONT $pid
sleep 3

That sleep is needed because the app may have opened the old log file prior to the first kill. We need to give time to do the write after the second kill.

But the real answer is that the app needs to be re-written to this by itself.

How about a script that when fired up, counts the number of lines in the log (`wc -l`) and then starts at the first of the file and has it processes log entries it deletes the log entries until the line count of the log file has been reached?

That way, you process messages, reduce the size of the log, but will not miss any added log entries, and because you start with the initial count of the lines of the log, you won't miss new log entries.

The only problem that I can think of is a situation where you delete and the app writes at the exact same time.

All log file to config at: /etc/syslog.conf = = > You can view and edit it. If you want control a log file:

- Add
- Del
- Stop
....