<div dir="ltr">It is a bit hard to believe that after receiving a HUP signal syslog-ng keeps destination files open, keep-alive isn't implemented there. did you signal the supervisor process maybe? I'd check syslog-ng's messages.<br>
<br>BTW did you check whether the file is still being written or not? You're using the date extracted from the incoming log messages so when a client still sends logs with the given day then syslog-ng will keep writing to that file so it won't close it - thus if another process unlinked it then lsof will show the file as deleted.<br>
</div><div class="gmail_extra"><br><br><div class="gmail_quote">On Wed, Jul 24, 2013 at 11:12 AM, Anton Koldaev <span dir="ltr"><<a href="mailto:koldaevav@gmail.com" target="_blank">koldaevav@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hi, I'm using Syslog-NG OSE v.3.3.7-1~mhp1~lucid (Ubuntu Lucid)<div>And I have the following destination file():</div>
<div><div> file("/u/logs/`app`/${MONTH}${DAY}/${1}/${1}${2}/${LOGSORT.ACCOUNT}.log"</div>
<div><br></div><div>Syslog-NG switches to the new file at 23:59:59 every day just fine but for some reason it leaves files for the previous day open:</div><div><div><b># date</b></div><div>Wed Jul 24 09:04:19 UTC 2013</div>
<div><div><b># lsof | grep a/ac/account.log</b></div><div>syslog-ng 30743 root 3351w REG 252,2 72597491 66306075 /u/logs/app/0723/a/ac/account.log (deleted)</div><div>syslog-ng 30743 root 4896w REG 252,2 17017519 4572052 /u/logs/app/0724/a/ac/account.log</div>
</div><div><br></div><div>And they're being deleted by my rotating script.</div><div>Reloading syslog-ng using init script or with `kill -HUP` doesn't help - all deleted files are still open by syslog-ng.</div>
<div><div>Global option "time_reap (30);" doesn't seem to help too.</div><div><br></div><div>Any ideas?</div><span class="HOEnZb"><font color="#888888"><div><br></div></font></span></div></div><span class="HOEnZb"><font color="#888888"><div>
<br></div>-- <br>Best regards,<br>Koldaev Anton
</font></span></div></div>
<br>______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
<br></blockquote></div><br></div>