When to use delaycompress option in logrotate?
Your understanding of copytruncate
is correct, but the wording in the manpage for delaycompress
is a little misleading. More properly, it should say "when some program cannot be told to immediately close it's logfile" -- for instance, if you're using sharedscripts and the script sends a signal to the process using the log when all the log files have been rotated.
We use:
- daily
- delaycompress
- nodateext
This creates fixed copy of the apache access_log
access_log.1
so that we can then run our Stats package as a script at the end of the day.
The following day logrotate compresses the file creating access_log.2.zip
Not sure if I completely understand your question, but if you're asking what I think...I use this:
postrotate
killall -HUP syslog-ng
endscript
That's a nice (or at least a) way to kill the log and move to the next. For "programs" that suck, such as Cisco's ASA platform that log tons of data per second, it works.