sadly this is not an easy problem as you need cooperation from the tool that does the logging
I suppose Un*x in the following. The main ideas probably apply to other OSes too.
If the tool opens, writes log info, closes the logfile each time, then a move-truncate scheme is posible
% mv $log $log.1 && > $log # mv-truncate
If the tool opens just once but does "straight" appends and fluhes, a copy-truncate scheme is usually ok. There is a "logging window that you loose"
% cp $log $log.1 && > $log # copy-truncate
the rest which is tough :(
A bad case but common enough: daemon opens once, seeks to end of last write, writes log info. If you truncate you get holes that count as NUL (Ascii 0) bytes if you cp for example. This often happens when the tool has different logging modes, and one of them is "circular logging". By the way renaming the file is of no use as the running process holds a descriptor to it. Even deleting does not work you'll get an hidden file (that is the old unix trick for having hidden temporaries, you open and unlink just after)
In some cases you can use the fifo trick. Stop the daemon, substitute the logfile for a fifo
(some systems might even have a special "/dev/log" driver) and some reader daemon, that dumps a file every x bytes say (perl is perfect here but youŽll need a reader manager is you use the scheme with more than a few processes). Restart the daemon, if it starts logging you are lucky (some processes
do a -f test, start complaining and bail out).
update: corrected typos.
hth
--stephan