I did a little test. When a file is open without O_APPEND then truncating the file while it is open results in a zero length file until the program holding the file open writes to it again. When the program holding the file open writes something then the file grows back to its original size plus what is written.
When a file is open with O_APPEND then when the file is truncated it will not grow back to its original size. Knowing a little about how Unix and Linux work this is what I would expect. I think that programs that write to a log file should open the log file with O_APPEND. This might be considered to be a bug in these programs. -----Original Message----- From: Linux on 390 Port [mailto:[EMAIL PROTECTED] Behalf Of Brandon S. Darbro Sent: Tuesday, March 07, 2006 3:36 PM To: [email protected] Subject: Re: Truncating logfiles puffing back up. I know when it will happen, my question is why? I don't have this problem on Solaris and HP. Is it a "feature" of the ext2 / ext3 filesystem? Or is will Linux do this on any of it's fs types? logrotate may be a useful solution for regular daemon log files, but it's also a problem with a users personal xsession log files as well. Fuzzy Logic wrote: > Sorry, sent too soon. > > Generally, you want to look at something like 'logrotate' for managing > your /var/log directory instead of directly messing with the log > files. > > Fuzzy > > On 3/7/06, Fuzzy Logic <[EMAIL PROTECTED]> wrote: > >> If a process is holding an open file handle, this will happen. >> >> Fuzzy >> >> On 3/7/06, Brandon S. Darbro <[EMAIL PROTECTED]> wrote: >> >>> I've run into this many times on Linux and I've finally decided I would >>> like to know why. >>> >>> If I truncate a logfile, say snmpd.log, with say: >>> >>> cat /dev/null > /var/log/snmp/snmpd.log >>> >>> It will result in a file size of 0 bytes... but the very next time the >>> process that holds it open write data to it, boom, the file is huge >>> again. The head of the file will be nulls until it reaches the new data >>> at the end. >>> >>> Why is this? On other unix's, when I zero a file, it grows slowly back >>> up from zero... not jumping back up to it's previous size and then >>> appending. >>> >>> *Brandon Darbro > > ---------------------------------------------------------------------- > For LINUX-390 subscribe / signoff / archive access instructions, > send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit > http://www.marist.edu/htbin/wlvindex?LINUX-390 > ---------------------------------------------------------------------- For LINUX-390 subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit http://www.marist.edu/htbin/wlvindex?LINUX-390 ---------------------------------------------------------------------- For LINUX-390 subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit http://www.marist.edu/htbin/wlvindex?LINUX-390
