Lofland bLOG

I’ve patched this together, some of my facts may be wrong, but I think the solution is right.
When an application is writing to a file, it may keep the file open. The application will “grab” the file and open a “handle.” If you delete the file, the application still has an open handle to the file’s “inode.” Deleting or moving the file out from under the application can have some bad affects. One possibility is that the applicatoin just keeps writing to the same handle, and the space is not cleared from the drive. So if your drive was filling up, it just keeps filling. Another possibility is that the application just gets upset and will not log anymore until you restart it.

The solution is to “zero” the file instead by simply running:

cat /dev/null > file_name

this has become such a common thing to do that on most Unix flavors this does the same thing:

> file_name

That will “zero” the file so that it is empty, but leave the inode alone, and the open handle that the applicatoin has open will still work, but now your disk wil have more free space again!

If you need to preserve the file’s contents, use the cp command to copy the file to somewhere else first befire you “zero” it. Then gzip the copy. Just don’t ever use mv or rm on an open file!

The best thing to do is stop the application, then move the log, then restart it, but usually you don’t want to do that, and besides, isn’t “uptime” what unix is all about? Also, some application simply open the file for each log entry and then close it again, in which case you can rm or mv the file, but knowing that is more difficult than just using the “zero” method above