samhain locks the logfile using a lock file. This lock file has the same path as the log file, with .lock appended. After sending SIGTTIN or SIGABRT to the samhain daemon, it will first finish its current tast (this may take some time), then unlock the log file (i.e. remove the logfile.lock file), wait three seconds, then proceed. Thus, to rotate the log file, you should use something like the following script:
#! /bin/sh if test -f /usr/local/var/run/samhain.pid; then \ PIN=`cat /usr/local/var/run/samhain.pid`; \ /bin/kill -TTIN $PIN; \ sleep 1; \ AA=0; \ while test "x$AA" != "x120"; do \ AA=$(( AA + 1 )); \ if test -f /usr/local/var/log/samhain_log.lock; then \ sleep 1; \ else \ break; \ fi \ done; \ fi mv /usr/local/var/log/samhain_log /usr/local/var/log/oldlog
If you use the 'logrotate' tool, you could use the following (untested):
/usr/local/var/log/samhain_log { weekly rotate 52 nocreate missingok compress prerotate if test -f /usr/local/var/run/samhain.pid; then \ PIN=`cat /usr/local/var/run/samhain.pid`; \ /bin/kill -TTIN $PIN; \ sleep 1; \ AA=0; \ while test "x$AA" != "x120"; do \ AA=$(( AA + 1 )); \ if test -f /usr/local/var/log/samhain_log.lock; then \ sleep 1; \ else \ break; \ fi \ done; \ fi endscript }