Removing log files with 'rm' can cause issues if processes are still referring to the files. It is better to move the log file first before deleting to avoid reference count issues. The "exact" way is to move the log file, restart any processes, and then delete the moved file once the process is no longer referring to it. This allows the reference count to reach 0 so the file can be safely deleted without interrupting services.

1. Do not ‘rm’ log files
Part time CTO
Masato Bito

2. Experience like this?
Daemon outputs lots of data into a log file
Disk becomes full
Service stops(no space left on device)
‘rm’ a huge log file(to get free space)
still disk full
Restart a daemon(stuck here, nothing comes up)
Ctrl-C doesn’t work
kill -KILL doesn’t work

3. “Wrong” way
to remove a log file

4. “Exact” way
to remove a log file

5. What is ‘rm’?
‘rm’ removes files

6. What does ‘rm’ do?
‘rm’ does “not” remove any file
‘rm’ removes links

7. What is a “link”?
A link on Unix system refers a file itself
link: /var/log/apache2/access_log
inode: 8823836

8. Who removes a file?
Kernel
Kernel provides only unlink(2) system call
man 2 unlink

9. When is a file removed?
When you can remove a file safely
Nothing refers a file

10. Garbage collection
Method to remove objects not used
Various algorithm

11. Reference counting
One of garbage collection algorithms
Each object counts the number of references
An object would be removed when references
became “0”

12. What was happened
/var/log/apache2/access_log httpd
8823836
log file
references: 2

13. What was happened
rm /var/log/apache2/access_log
8823836
log file
references: 1
httpd

14. What was happened
service httpd restart
8823836
log file
references: 0
httpd
stuck
start removing

15. Exact way
mv access_log access_log2
/var/log/apache2/access_log2 httpd
8823836
log file
references: 2

16. Exact way
service httpd restart
8823836
log file
references: 1
httpd
/var/log/apache2/access_log2
8823837
log file
references: 2
/var/log/apache2/access_log

17. Exact way
rm access_log2
8823836
log file
references: 0
httpd
/var/log/apache2/access_log2
8823837
log file
references: 2
/var/log/apache2/access_log
stuck
start
removing

18. log rotation
mv access_log access_log.2
kill -HUP <pid>
gzip access_log.2

19. Wait

20. kill -HUP
Hang Up Signal?

21. Next:
Why SIGHUP is used
to reload files

22. Thanks