vi backup files considered harmful : technovelty

Mark this one down as another in the long list of "duh" — once you realise what is going on!

Bug report comes in about a long running daemon that has stopped logging. lsof reports the log file is now named logfile~ and further more is deleted! This happens after a system upgrade scenario, so of course I go off digging through a multitude of scripts and what-not to find the culprit...

Have you got it yet?

Try this...

# lsof | grep syslogd | grep messages
syslogd    1376        root   15w      REG        3,1    99851    4605625 /var/log/messages

# cd /var/log/
# vi messages (and save the file)

root@jj:/var/log# lsof | grep syslogd | grep messages
syslogd    1376        root   15w      REG        3,1    99851    4605625 /var/log/messages~ (deleted)

vi is very careful and renames your existing file, so that if anything goes wrong when writing the new version you can get something back. It's a shame the daemon doesn't know about this! The kernel is happy to deal with the rename, but when the backup file is unlinked you're out of luck. Confusingly to a casual inspection your log file looks like it's there ... just that nothing is going into it. (oh, and if you tried that, you might like to restart syslogd now :)

Moral of the story -- overcome that finger-memory and never use vi on a live file; you're asking for trouble!

posted at: Fri, 08 Jan 2010 16:15 | in /linux/tips | permalink | add comment (6 others)

Posted by James Vega at Sat Jan 9 13:40:27 2010

Was this Vim or another vi clone? With Vim, you can "set backupcopy=yes" to do a "copy orig to backup, truncate orig, write new content to orig" which avoids the problem of the rename.

Of course, editing a live log file (with any editor) is a bad idea since you have the potential to overwrite logs that were emitted after opening the file in the editor.

Posted by Jeff Schroeder at Sat Jan 9 13:42:07 2010

In other news, try using vi -R or view. Then you will be warned the file is readonly and have to force save.

Posted by glandium at Sat Jan 9 16:37:10 2010

It seems you may be in need to relink you file... Check http://glandium.org/blog/?p=87 (and look at the comments, they include easier ways to get the inode number)

Posted by Franklin Piat at Sat Jan 9 23:52:13 2010

Editing a log file (or any open file)... what a very bad idea.
Stop the daemon, modify, restart the daemon.

Posted by Marcus Bauer at Sun Jan 10 08:30:21 2010

I have the same habit of using vi instead of less. And i have used it many times on /var/log/messages too. My finger memory is to always do a :q! unvi^H^Hunless I want to explicitly save a file.

However, I'll try to use view in future - which I didn't know before I read Jeff's comment.

Posted by Jan Hudec at Mon Jan 11 18:33:58 2010

You can even set vim to not allow you to write to modify a log file unless you explicitly override.

In your .vimrc (that would be /root/.vimrc -- log files are not writable by normal users, right), put something along the lines of:

augroup readonly_files

au BufNewFile,BufRead /var/log/* set readonly,nomodifiable,backupcopy=yes

augroup END

Now any file under /var/log will be open as readonly,nomodifiable. The readonly flag will prevent writing the file, unless ! is added to w or x command. The nomodifiable will prevent any command entering insert mode or doing modification to the buffer. Omit one or the other if you want. The backupcopy is mixed in to prevent vi moving the file if you decide to override the readonly.

Oh, and note that vim will ask for confirmation on writing a file that has changed (checks mtime), which should limit the probability of loosing some messages when editing a log file.

Add a comment
*Name
*Email (not shown)
Website
*Comment:
Anti-spam:

	* denotes required field

technovelty

weblog of Ian Wienand

Categories

Archives

Feedback

vi backup files considered harmful