How does logrotate interact with hard linked files?

To answer your question, it kind of depends on what kind of rotating you do. For instance, the following progression will happen:

Copy-and-truncate method:

1. Logrotate copies the logfile to a new logfile.
   • The new logfile only shows up in the old location yet.
2. Logrotate truncates the old file.
   • This turns the old file to zero bytes in both locations.
3. Logfile continues to fill from the application.

This leaves the logfile backups in the old location.

The fix to this is fairly simple: configure logrotate to rotate the logs in the new location. The old one will still have the growing file, but it'll only be the one.

Copy-and-create method:

1. Logrotate copies the file to a new logfile.
   • This logfile is not hardlinked, and only shows up in the new location.
2. Logrotate removes the old log-file.
   • Due to hardlinking, this just removes the hardlink in the directory logrotate runs against. The other directory will still have a complete copy of the file.
3. Logrotate creates a new logfile.
   • This will not be hardlinked to the other location.

This method is most problematic, and you'll need some post-rotate magic to clean up after it.

Do not link to the files: link to the directory. If you link to the file, you may have a problem when the application creates a new log file, either as part of log rotation (depending how that is done) or when you stop and later restart the application.

ln -s /path/to/where/application/creates/logs/ /var/log/application