Feature #265

reopen log file to support log rotate

Added by delta yeh over 9 years ago. Updated over 7 years ago.

Target version:


It would be better if suricata can receive a USR signal and reopen log file, so log ratate can
be done easily.


Updated by Victor Julien over 9 years ago

  • Assignee set to Victor Julien
  • Target version set to 1.1beta2

Will be a task to one of the OISF devs.


Updated by Victor Julien about 9 years ago

  • Target version changed from 1.1beta2 to 1.1beta3

Updated by Victor Julien over 8 years ago

  • Target version changed from 1.1beta3 to 1.2

Updated by Victor Julien over 8 years ago

  • Status changed from New to Closed
  • Target version deleted (1.2)


cp http.log http.log.1 && > http.log

I tested this and it works.


Updated by Jorgen Bohnsdalen over 7 years ago

Today Suricata (1.3.1) doesn't reopen the logfiles when doing a logrotate. Since HTTP-logs tend to be huge, it'd be nice if Suricata supported receiving a signal for re-opening log-files. The solution provided here is not a solution for this feature. Logrotating is something that most definitely should be supported without restarting Suricata (and possibly suffering a few minutes of downtime).


Updated by Victor Julien over 7 years ago

Did you try the solution at comment 4? It works fine for me w/o the need for restarting Suricata.


Updated by Jorgen Bohnsdalen over 7 years ago

Yes, I tried it. It ends up wiping both files and Suricata continues to write to http.log.1.


Updated by Matt Jonkman over 7 years ago

Verified. Moving files does not change log output. Deleting the file causes logging to stop.


Updated by Digital Ninja over 7 years ago

Victor's solution on #4 seems to work fine on Ubuntu 12.04/64-bit. Alternatively, logrotate is also working for me with this configuration:

/var/log/suricata/http.log {
rotate 7
echo > /var/log/suricata/http.log
chown ids:ids /var/log/suricata/http.log


Updated by Ludovico Cavedon over 7 years ago

Victor Julien wrote:

cp http.log http.log.1 && > http.log

Isn't there a race condition here?
If suricata writes an entry between "cp http.log http.log.1" and "> http.log" you lose it...

Also available in: Atom PDF