[syslog-ng] Behavior when followed files are renamed

[Joe Shaw]

Hi again,

On Thu, Dec 11, 2008 at 6:01 PM, Joe Shaw <joe at joeshaw.org> wrote:
> Assuming that syslog-ng is monitoring the file, is there a possibility that:
>
> 1. The file is renamed
> 2. syslog-ng is fully caught up and hits the EOF
> 3. The new file isn't created yet, but syslog-ng is waiting for it to be created
> 4. The app continues to write some data out to the old, renamed file
> 5. The app is signaled and reopens the file; syslog-ng starts monitoring it
>
> I am making an assumption in #3 which might not be true -- that
> syslog-ng when it encounters EOF but the file isn't recreated that
> it'll abandon the renamed file.  If that's not true, then there's no
> race and I'm happy. :)

On re-reading my email, I realize I may not have conveyed the problem
well enough.

The worry is that in #2 syslog-ng will hit EOF and stop monitoring the
old, renamed file even if the app might still write to it before it
has been reopened.  That is, the data in #4 would never be processed
by syslog-ng.

Joe