Feature Request: Leave X MiB in the original logfile

[mrosic]

We're using logrotate to rotate our OpenShift/Docker logs, our clients only have access to the logs via "oc logs" or "kubectl logs". Each time the Docker logs get rotated our customers don't get any (or very little) output from "oc logs" because the files have been rotated.

It would be very nice to have a function in the likes of "logrotate should rotate the logs when they reach 100 MiB but it should leave 10 MiB of logs in the old file".

[jankaluza]

Hm, as an idea, it looks interesting, but the implementation does not seem to be straightforward to me...

Let's say you have 100 lines long log file and you want to keep last 10 lines there. Logrotate would have to open the log file, copy first 90 lines to log.1 file and then somehow remove those 90 lines from the log file and move the 10 lines to beginning of file.

There are few ways how to move those 10 lines to the beginning of log file:

a) Open the log file for writing and overwrite beginning of the file with last 10 lines, then truncate the file. I'm not sure if all daemons handle truncate like they should, so that's no-go. There is also problem when daemon writes new log message after we copy last 10 lines, but before we truncate.

b) Stop the logging daemon, replace log file with new one containing just last 10 lines of the original one. This is no-go,

c) Use fallocate with FALLOC_FL_COLLAPSE_RANGE. This will work only on ext4 or XFS on Linux 3.15, so it's not so useful.

Maybe what you need is postrotate script which would copy last 10 lines of rotated log to the newly created log before letting the daemon to reopen the log files.

[mrosic]

Correct me if I'm wrong, but isn't "copytruncate" pretty close to what you have described in a)?

The requested function could be an extension to "copytruncate", much like "delaycompress" only does something if "compress" is also set in the config file.