wwalker / beaver Goto Github PK

22:37:16.316753 access("/var/log/funnel.log", F_OK) = -1 ENOENT (No such file or directory)
^ This is OK, we try to rename the file at start

# Now we create the first funnel.log
22:37:16.316792 open("/var/log/funnel.log", O_RDWR|O_CREAT|O_APPEND|O_LARGEFILE|O_CLOEXEC, 0644) = 7

# and it is there until we decide to rotate it:
22:37:16.316928 access("/var/log/funnel.log", F_OK) = 0
22:37:27.637259 access("/var/log/funnel.log", F_OK) = 0
22:37:27.637432 access("/var/log/funnel.log", F_OK) = 0
22:37:27.637682 access("/var/log/funnel.log", F_OK) = 0
22:37:27.637793 access("/var/log/funnel.log", F_OK) = 0

# We rename it and funnel.log is, expectedly, gone:
22:37:27.637854 rename("/var/log/funnel.log", "/var/log/funnel.log.2023-08-23T22.37.27.9637776910Z") = 0
22:37:27.637908 access("/var/log/funnel.log", F_OK) = -1 ENOENT (No such file or directory)

# We open a new funnel.log, and it is there a millisecond after we create it
22:37:27.638023 open("/var/log/funnel.log", O_RDWR|O_CREAT|O_APPEND|O_LARGEFILE|O_CLOEXEC, 0644) = 7
22:37:27.638186 access("/var/log/funnel.log", F_OK) = 0

# One second later, the NEW funnel.log is gone.  We didn't delete it.
# Looking in ls -l /proc/$$/fd we see fd 7 is open and the file is growing, but ...
# its name is now (deleted), meaning the kernel has removed the dirent for the
# NEW funnel.log
22:37:28.640370 access("/var/log/funnel.log", F_OK) = -1 ENOENT (No such file or directory)
22:37:31.609737 access("/var/log/funnel.log", F_OK) = -1 ENOENT (No such file or directory)
22:37:31.609922 access("/var/log/funnel.log", F_OK) = -1 ENOENT (No such file or directory)
22:37:31.610257 access("/var/log/funnel.log", F_OK) = -1 ENOENT (No such file or directory)
22:37:31.610462 access("/var/log/funnel.log", F_OK) = -1 ENOENT (No such file or directory)
22:37:31.611112 rename("/var/log/funnel.log", "/var/log/funnel.log.2023-08-23T22.37.31.9610427158Z") = -1 ENOENT (No such file or directory)