Suricata

Today Suricata (1.3.1) doesn't reopen the logfiles when doing a logrotate. Since HTTP-logs tend to be huge, it'd be nice if Suricata supported receiving a signal for re-opening log-files. The solution provided here is not a solution for this feature. Logrotating is something that most definitely should be supported without restarting Suricata (and possibly suffering a few minutes of downtime).

Did you try the solution at comment 4? It works fine for me w/o the need for restarting Suricata.

Yes, I tried it. It ends up wiping both files and Suricata continues to write to http.log.1.

Verified. Moving files does not change log output. Deleting the file causes logging to stop.

Victor's solution on #4 seems to work fine on Ubuntu 12.04/64-bit. Alternatively, logrotate is also working for me with this configuration:

compress
/var/log/suricata/http.log {
rotate 7
daily
copy
postrotate
echo > /var/log/suricata/http.log
chown ids:ids /var/log/suricata/http.log
endscript
}

Victor Julien wrote:

cp http.log http.log.1 && > http.log

Isn't there a race condition here?
If suricata writes an entry between "cp http.log http.log.1" and "> http.log" you lose it...