logrotate copytruncate loses lines; create does not

The default rotation renames the file and creates a new one — but a process holding the old file descriptor keeps writing to the renamed file, so the new log stays empty until restart. copytruncate is the usual fix and it has a cost nobody mentions.

# copies, then truncates in place — anything written
# between the two operations is gone
/var/log/app/*.log {
    daily
    rotate 14
    compress
    copytruncate
}

# better: rotate properly and tell the process to reopen
/var/log/app/*.log {
    daily
    rotate 14
    compress
    create 0640 deploy adm
    postrotate
        kill -USR1 `cat /var/run/app.pid`
    endscript
}

The copy and the truncate are not atomic, so a busy log loses whatever was written in between — rarely enough to go unnoticed, often enough to matter when the missing lines are the ones you needed. If the process can reopen its log on a signal, create plus postrotate is lossless. copytruncate is for software that cannot.