From ae1c6a7b49d9b4f8cf7218c0baec84f348eb5ef6 Mon Sep 17 00:00:00 2001
From: bitflash-maintainer <noreply@bitflash.invalid>
Date: Wed, 2 Sep 2026 05:26:51 +0000
Subject: log: cap debug.log in-process, and ship a logrotate policy

debug.log grew without bound (production: 1.95 GiB, 51-129 MB/day).
Nothing shrank it once the process was up -- there is no
ShrinkDebugFile in this tree, and upstream's only ran at startup.

OutputDebugStringF now rolls the file to debug.log.old when it
passes -maxdebugfilesize (MB, default 1024, 0 disables). The write
path already opens and closes the file per line under one lock, so
the rename-and-reopen is a few lines inside that lock and no fd can
be stranded mid-roll.

contrib/logrotate/bitflash-debug.logrotate is the longer-term policy
(size 1G, rotate 4, compress, missingok, notifempty, copytruncate);
copytruncate keeps the writer's append handle valid across rotation.

Closes #34
---
 src/util.h | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

(limited to 'src/util.h')

diff --git a/src/util.h b/src/util.h
index d72518b..f2ea23f 100644
--- a/src/util.h
+++ b/src/util.h
@@ -87,6 +87,11 @@ inline T& REF(const T& val)
 
 extern bool fDebug;
 
+// debug.log is rolled to debug.log.old once it grows past this many bytes
+// (set from -maxdebugfilesize, in MB; 0 disables the check). See the roll
+// site in OutputDebugStringF() below.
+extern int64 nMaxDebugFileSize;
+
 // ---------------------------------------------------------------------------
 // Categorized, burst-collapsing logging
 //
@@ -391,6 +396,30 @@ inline int OutputDebugStringF(const char* pszFormat, ...)
                 strDebugFile = "debug.log";
         }
         FILE* fileout = fopen(strDebugFile.c_str(), "a");
+        if (fileout && nMaxDebugFileSize > 0)
+        {
+            // Roll an overgrown debug.log before adding to it. Nothing in the
+            // tree shrinks this file once the process is running (there is no
+            // ShrinkDebugFile, and even Bitcoin's only ran at startup), so a
+            // node that stays up for months grows the log without bound --
+            // production hit ~2 GiB. The file is opened and closed per line,
+            // so a rename is safe here: the next line simply reopens the
+            // path. One generation is kept as debug.log.old; logrotate
+            // (contrib/logrotate/) handles anything longer-term.
+            int nSize = GetFilesize(fileout);
+            if (nSize >= 0 && (int64)nSize > nMaxDebugFileSize)
+            {
+                fclose(fileout);
+                string strOldFile = strDebugFile + ".old";
+                remove(strOldFile.c_str()); // rename() won't clobber on Windows
+                rename(strDebugFile.c_str(), strOldFile.c_str());
+                fileout = fopen(strDebugFile.c_str(), "a");
+                if (fileout)
+                    fprintf(fileout,
+                        "debug.log grew past %lld MB; previous contents moved to debug.log.old (-maxdebugfilesize)\n",
+                        (long long)(nMaxDebugFileSize / 1024 / 1024));
+            }
+        }
         if (fileout)
         {
             va_list arg_ptr;
-- 
cgit v1.2.3