I have an instance of 389-Directory running 1.4.4 on CentOS, for which we keep an audit log. We've established size-based log rotation.

To reduce the likelihood of the audit log being accidentally altered, I'd like to mark it as 'append only', using 'chattr': chattr +a audit.log

This works great, until rotation time. Since "rename" is not "append", any effort to mv the file out of the way fails. Is there a pre/post-rotation mechanism through which I could: disable the append-only restriction let the log rotation happen re-enable append-only on the new log file