IDS/9000 error log rotation

[Bosco Tsang]

I have a log rotation script running which will rotate the alert.log and error.log weekly. There is no stop and start action on idsagent afterward as it seems do not startup via script. After the rotation, the alert.log messages are appending okay, but for the error.log message, it will still append to the old error.log which I already mv to error.log.1. The error.log remain empty (which I touch after the rotation). Any idea why so, and how can I set it so it will append the error.log messages back where it should

[James R. Ferguson · Accepted solution]

Hi:

One way to circumvent this is to copy the log file and then null its contents ('cat /dev/null > mylog'). In this manner, the (already) open file descriptor is retained and logging will continue.

Regards!

...JRF...

[Pierre Pasturel]

fyi, I have filed a defect against the product. The agent neglects to stat() the error.log file to see if it has changed and instead keeps using the open file descriptor of the error.log file you moved. As you noticed, we do it correctly for the alert file.

Thanks for the feedback.

Pierre