Bug #1402: When re-opening files on HUP (rotation) always use the append flag. - Suricata - Open Information Security Foundation

Actions

Copy link

Bug #1402

closed

When re-opening files on HUP (rotation) always use the append flag.

Added by Jason Ish almost 10 years ago. Updated almost 10 years ago.

Status:

Closed

Priority:

Normal

Assignee:

Jason Ish

Target version:

2.1beta4

Affected Versions:

Effort:

Difficulty:

Label:

Description

Currently if a rotation tool (logrotate, etc) has not moved all of the log files out of the way, the SIGHUP will re-open them, truncating them if there is already data. This is not expected behaviour if a rotate script (or person) has not moved the file out of the way.

By always opening in append mode during rotation, files that were moved out of the way will be be created, and files that weren't will simply be appended to.

Reported by iro on IRC.

Current PR: https://github.com/inliniac/suricata/pull/1348