Hi,<div><br><div class="gmail_quote">On Wed, Jul 4, 2012 at 9:47 AM, Balazs Scheidler <span dir="ltr"><<a href="mailto:bazsi77@gmail.com" target="_blank">bazsi77@gmail.com</a>></span> wrote:<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
I don't see that the fact the file is growing while syslog-ng is being<br>
reloaded would cause something like this. it is designed to handle<br>
these cases properly.<br></blockquote><div><br></div><div>Log rotation happens at 6:25. This error line happens exactly once a day, at 6:25:02 (it is always the first line of the newly created syslog file). </div><div>The error message is quite clear about what syslog-ng is doing (and indeed that's what is happening) and why it is doing so (the filesizes reported are plausible. But I only assumed syslog-ng was not lying about the fact this was indeed the real cause of its behavior). </div>
<div><br></div><div>My configuration seems so basic to me that I can't believe I'm the only doing such a thing and I can't understand such a classical thing is not working for me.</div><div><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
I even tried to reproduce the issue with my 3.4 tree and couldn't.<br></blockquote><div><br></div><div>Then I guess I'll have to try 3.4. </div><div><br></div><div>That may solve another issue I have, that may be related. I have several webservers whose logs are transfered and aggregated on one central box in the same file. I did not investigate enough to make a full report, but the central log file is corrupted (different lines seem to mix!) and it seems to me that's related to the previous fact since it seems to happen only to files that are reread from the start.I thought it may happen because syslog-ng would catch up to the end of the file with a bulk transfert and switch to a line by line transfert afterwards, or because one line fits on a buffer and not a whole file. Because logrotation happens at the same time on all webservers, all bulk transfers reach the central box at the same time. They are then written as they come and are interleaved. Because some lines overlap between 2 buffers on one webserver, if a buffer from another one is written in the middle, we have a corrupted log file. Is it possible ?</div>
<div><br></div><div>Thanks for the help!</div></div></div>