[wplug] apache access logs

[Mark Dalrymple]

> That's my understanding of it anyways, someone can feel free to correct
> me.

That's pretty close.  A file on the disk has reference count, and the
blocks are freed when the reference count goes to zero.  Hard links
contribute to this reference count, as does the file being in a directory.

When a program opens a file, the reference count goes up too.  That
way you can delete a file that a program still has open, and the program
won't freak out (since the disk blocks are still there).  This can
have the unfortunate side-effect of someone removing their log file
and not seeing their disk consumption going down.

In this case, something similar was happening, the access log got
removed, but Apache still had a reference to it, so it was happily
writing to the log.  Restarting apache caused it to release its
reference, the space get reclaimed, and the new instance created a new
file.

> when you do an OPEN(filename) - that
> creates a file handle.  it doesn't pay any attention to future changes
> done to that file in the os (like moving or deleting)

Pretty much.  The program will see changes to the file made by another
program (someone could open the access log, scribble some new stuff in
the first couple of bytes)

All this and much more can be found in my expensive book mentioned on
slashdot :-)

++Mark Dalrymple, markd at badgertronics.com.  http://badgertronics.com
  "I keep forgetting that 'cow' is gender specific"