How to trim the logfiles with active process writing to?

[Aldis Black]

This are the logfiles of rootsh (keystroke logging tool). Looks like it is tracking the file indeed - just tried to move the logfile and it keeps writing to it anyway!
Still i need to find a way to trim those files as the users keep the sessions open for several days and the logfiles grow fast. Please advise!

[James R. Ferguson]

Hi Aldis:

# > filename

or:

# cat /dev/null > filename

If no process is using the file, it will be reduced to a size of zero.

If a process is using the file, then this will return disk blocks to the system but will not change the length of the file that the process with the file open "sees". Rather the file will be sparse with nulls at its beginning. This is generally not an issue for log files.

Regards!

...JRF...

[TTr]

> just tried to move the logfile and it keeps writing to it anyway!

Does rootsh accept a HUP signal?

# mv logfile logfile-old
(the logfile-old is still open and written to)

# kill -HUP rootsh-PID
(The -HUP signal *might* make the rootsh start a new logfile under the original name)

[Court Campbell]

I have always been a fan of he truncate function in perl.