An in-house daemon holds its log file open and offers no way of being told to reopen it. After each rotation it keeps writing into the renamed file, so the new log stays empty. Which logrotate directive resolves this?
LPIC-1 Exam 102-500, objective 108. Essential system services hard
Machine-checked — no person has signed for it. This question was read against the source cited below by an automated pass, which found no contradiction. That is a weaker claim than it sounds: the same kind of process wrote the question, so it can confirm its own mistake.
Treat it as a good draft rather than as settled fact, and read the source below before you rely on it. It is not used in mock exams here — only questions a person has signed for are.
How these questions are written — where each question comes from, what the verification ledger records, and what happens when one is found wrong.
The options
Correct copytruncate
Correct. logrotate copies the file's contents to the rotated name and then truncates the original in place, so the inode the daemon has open is preserved and its writes continue into the current log.
Not correct create 0640 root adm
Wrong for this daemon. create makes logrotate produce a fresh empty file with the given mode and ownership immediately after the rename, but the daemon's descriptor still refers to the renamed inode, so it goes on filling the old file.
Not correct delaycompress
Wrong. It postpones compressing the most recently rotated file until the following cycle. That is a common companion to copytruncate, because a file still being written must not be gzipped, but it does not by itself redirect the writes.
Not correct sharedscripts
Wrong. It makes prerotate and postrotate scripts run once for the whole set of files matched by a wildcard pattern rather than once per file. It affects script invocation, not file handles.
Why
The default rotation is a rename followed by the creation of a new file, which only works if the writing process reopens its log — which is what the postrotate scripts calling systemctl reload or kill -HUP are for. copytruncate is the fallback when no such signal exists, and it carries a small race: anything written between the copy and the truncate is lost. It is therefore the exception, not the default.
Where this comes from
- Cited
- manual page logrotate(8)
Practise this
Reading one question is not practice. The trainer will draw a short set from objective 108 and space the ones you get wrong.
More questions on this objective
- You corrected the running system's clock with `date -s`, but after the next power cycle the machine came back with the old wrong time. Which command copies the corrected system clock into the hardware (RTC) clock? machine-checked
- On a systemd-based distribution, which file determines the local time zone used by the C library when formatting times? machine-checked
- A host runs chrony as its NTP client. Which command shows the list of time sources chrony is currently talking to and how it rates each one? machine-checked
- In /etc/ntp.conf you find the line `server 0.pool.ntp.org iburst`. What does the `iburst` keyword do? machine-checked
- A minimal systemd host synchronises its clock with systemd-timesyncd. Which statement about that service is accurate? machine-checked
- On a systemd host, type the single command that turns on automatic network time synchronisation (do not include a path). machine-checked