When to use delaycompress option in logrotate?

Solution 1:

Your understanding of copytruncate is correct, but the wording in the manpage for delaycompress is a little misleading. More properly, it should say "when some program cannot be told to immediately close it's logfile" -- for instance, if you're using sharedscripts and the script sends a signal to the process using the log when all the log files have been rotated.

Solution 2:

We use:

• daily
• delaycompress
• nodateext

This creates fixed copy of the apache access_log access_log.1 so that we can then run our Stats package as a script at the end of the day.

The following day logrotate compresses the file creating access_log.2.zip

---

Solution 3:

Not sure if I completely understand your question, but if you're asking what I think...I use this:

postrotate
          killall -HUP syslog-ng
  endscript

That's a nice (or at least a) way to kill the log and move to the next. For "programs" that suck, such as Cisco's ASA platform that log tons of data per second, it works.