LPIC-1 Shells, Scripting and Data Management Practice Question
A systems administrator maintains a Linux web server running Apache HTTP Server (version 2.4) with three virtual hosts. The server logs are stored in /var/log/httpd/ and are rotated using logrotate, which is configured with the default settings that came with the Apache package. The administrator has noticed that after the nightly log rotation, the main access log file (access_log) is empty, while the rotated log files (e.g., access_log.1, access_log.2) contain the previous day's data. Furthermore, new HTTP requests are being logged into the most recent rotated file (access_log.1) instead of the current access_log file. The administrator has verified that the logrotate cron job runs successfully, and that the log files are owned by the root user with read/write permissions for the root group. No errors appear in the system logs. The Apache service continues to run and serve web pages. Which of the following actions should the administrator take to ensure that Apache writes new log entries to the current access_log file after rotation?
⚠ Common exam trap
Many candidates think 'copytruncate' is a safe, signal-free solution, but they overlook the risk of data loss between the copy and truncate operations, making the postrotate signal method the correct and reliable choice for Apache.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a postrotate script to the logrotate configuration that sends a USR1 or HUP signal to the Apache process to cause it to reopen the log files.
The issue is that after logrotate moves the current access_log to access_log.1, Apache continues writing to the old file descriptor (now pointing to access_log.1) because it never reopened the log file. Sending a USR1 or HUP signal to Apache causes it to close and reopen its log files, creating a new access_log and writing new entries there. This is the standard method for log rotation with Apache and other daemons that keep file handles open.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Modify the Apache configuration to set the 'RotateLogs' directive and restart the service.
Why it's wrong here
Apache 2.4 has no RotateLogs directive; log rotation is handled by logrotate, not httpd.conf, so this line would be rejected at startup. It tempts administrators used to other servers offering built-in rotation, but here the fix is signalling Apache to reopen its descriptors.
- ✓
Add a postrotate script to the logrotate configuration that sends a USR1 or HUP signal to the Apache process to cause it to reopen the log files.
Why this is correct
Apache holds the original file descriptor after logrotate renames access_log, so it keeps writing to the renamed inode (access_log.1). Sending USR1 or HUP triggers Apache to close and reopen its log files, binding them to the newly created access_log.
- ✗
Change the logrotate frequency to 'weekly' so that the log is not rotated as often.
Why it's wrong here
Rotation frequency does not affect Apache's open file handle; the daemon keeps writing to the renamed inode until restarted or signalled. Weekly rotation merely delays the symptom. It would help only if log volume or retention policy, not post-rotation write redirection, were the concern.
- ✗
Set the 'copytruncate' directive in the logrotate configuration to copy the log file and truncate the original, so Apache can continue writing without interruption.
Why it's wrong here
copytruncate leaves Apache holding the same inode, so it keeps writing to the truncated file rather than the new access_log; the stem shows the process still holds the old descriptor, which a reload would release. It suits programs that cannot reopen logs, such as some daemons lacking a signal handler.
Go deeper
Related to this question
About these practice questions
Courseiva writes every LPIC-1 question from scratch — 402 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This LPIC-1 practice question is part of Courseiva's free LPI certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the LPIC-1 exam.