I have a bunch of ec2 instances running web services; every hour I want to copy the logs back to S3. Which works perfectly well.
But, it appears if I move the logs and then touch a new file, or just write the contents to 0 Apache stops writing the logs from that point.
How is it best to do this?
Log files are accessed through their file descriptor (inode), not their name.
To rotate apache logs safely you must re-create the log file and then restart apache.
Most distros come with apache logrotate settings preconfigured; take a look at those.
Usually, the logrotate scripts issue a
reload(sendSIGHUP) to the running process after doing the logrotation and creating a new log file. This enables the running process (apache in your case) to reopen the log file and continue to write logs to the right file descriptor.