From: Jason Ish <ish@unx.ca>
Date: Fri, 27 Feb 2015 17:30:47 +0000 (-0600)
Subject: When re-opening a log file on HUP, always append.
X-Git-Tag: suricata-2.1beta4~169
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=ab1d69fc4eb0e4ccd8902c198af0cb94fce1e696;p=thirdparty%2Fsuricata.git

When re-opening a log file on HUP, always append.

This will prevent log files that have not been rotated by some
external tool from being deleted, but log files that were
rotated (moved out of the way) will be re-opened.

This is a better default behaviour, especially when not all
log files are rotated at the same time.

Thanks to iro on IRC.
---

diff --git a/src/util-logopenfile.c b/src/util-logopenfile.c
index 4e42ceef40..fcef26d623 100644
--- a/src/util-logopenfile.c
+++ b/src/util-logopenfile.c
@@ -251,9 +251,10 @@ int SCConfLogReopen(LogFileCtx *log_ctx)
 
     fclose(log_ctx->fp);
 
-    /* Reopen the file.  In this case do not append like may have been
-     * done on the initial opening of the file. */
-    log_ctx->fp = SCLogOpenFileFp(log_ctx->filename, "no");
+    /* Reopen the file. Append is forced in case the file was not
+     * moved as part of a rotation process. */
+    SCLogDebug("Reopening log file %s.", log_ctx->filename);
+    log_ctx->fp = SCLogOpenFileFp(log_ctx->filename, "yes");
     if (log_ctx->fp == NULL) {
         return -1; // Already logged by Open..Fp routine.
     }