Just discovered that logrotate is not rotating our firewall log. So its up to 12g in size.

I need to split up the file into smaller chunks and start manually rotating them so I can get things back on track.

However before I start splitting the firewall up, I need to stop the firewall from logging to the current firewall log file and force it to start logging to a new empty file. This way I'm not trying to split up or rotate a log file that is still constantly growing.

I tried to simply do this:

mv firewall firewall.old touch firewall

I expected to see the new empty firewall file to start growing in size, but no... the firewall.old is still be logged to.

Then I tried to start/stop iptables. No change. firewall.old is still the log file.

I tried to move it to another directory. That didn't help.

I tried to stop iptables, then change the filename and create a new firewall file and then start iptables again, but no change.

How do I stop the logging on this file and force it to start logging on a new file?