Open ultraji opened 2 years ago
Truncate and append don't make any sense together. Truncate truncates, there's nothing to append to.
You said "when logrotate to rotate the log file" ... if lumberjack is writing to the file, you can't have logrotate rotating the file. Lumberjack won't know the file has changed, and will continue writing at the place on disk it last knew to be the end of the file. That's probably the problem. You can't have any other application changing the log file. Only lumberjack can change it.
I agree that "You can't have any other application changing the log file" .But in my opinion, with O_APPEND flag, "The file is opened in append mode. Before each write(2), the file offset is positioned at the end of the file, as if with lseek(2)", so Lumberjack can know when the file is truncated.
https://github.com/natefinch/lumberjack/blob/47ffae23317c5951a2a6267a069cf676edf53eb6/lumberjack.go#L235
My scene(kube-apiserver audit.log):
audit.log
file before, it will be open by flag 'os.O_CREATE|os.O_WRONLY|os.O_TRUNC',so whenlogrotate
to rotate the log file, i'm getting binary thrash in log file, andaudit.log
keeping growing.audit.log
file before, it will be open by flag 'os.O_APPEND|os.O_WRONLY', so whenlogrotate
to rotate the log file,copytruncate
works well, andaudit.log
is truncated as we hope.In my test:
I add
O_APPEND
flag here, everthing work well, andaudit.log
is truncated as we hope. so is it needed to add 'O_APPEND' flag here?