mod_security audit_log empty file truncated

[ramprage]

While tail -f audit_log to watch for some recent rules I added, It just showed up this message:

tail: audit_log: file truncated

NowI see the log file is completely empty...

-rw-r--r-- 1 root root 0 May 17 18:01 audit_log

Anyone see this happening before, and know why?

 

[mctDarren]

Tail textinfo:

if the tracked file is determined to have shrunk, `tail' prints a message saying the file has been truncated and resumes tracking the end of the file from the newly-determined endpoint.

Saw this once before, still don't know why. Maybe as you tailed the file it was hit by the restarted service and somehow tail read the file as shrinking. Wondering if tail itself might be nulling the file on some glitch when this happens...

[edit]Hmmm, maybe restart of mod_security triggers a truncate/rewrite of the log for some reason... it's late and the brain is crawling...[edit]