Timeline for How to determine the newly closed file within a continuous audit log rotation?
Current License: CC BY-SA 3.0
3 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jul 25, 2014 at 1:41 | vote | accept | D-Klotz | ||
| Jul 24, 2014 at 9:23 | comment | added | mr.spuratic |
You might find fuser faster and easier, fuser -s filename will (silently) return 0 if filename is open. For similar purposes I usually use a program called retail which cashes filename/size/inode so log content can be incrementally processed without missing anything. Whether you can use that depends on the filename(s) and rotation mechanism (i.e. preservation of inode number).
|
|
| Jul 22, 2014 at 15:34 | history | answered | D-Klotz | CC BY-SA 3.0 |