Like all Unix file systems, open log files can cause a real problem when they get too large and need to be deleted. The problem is, if you delete an open file, the link is removed, but all of the inodes are lost. Even worse, if the program continues to log to the file, the link never re-appears, and additional inodes are lost and are unrecoverable. I suggest two solutions to the above problems.
If you have lost inodes, a simple reboot (make sure FSCK is run on startup) will recover lost inodes and missing filespace.
To empty (or zero out) an open log file, simply issue the following command:
date > logfile
This will \'empty\' the file and insert as the first line the output from the date command. If you want a completely empty file, don\'t enter date,
just > logfile.
This works great on apache and other web server logs, without ever stopping the service.