<div dir="auto">No clue. Maybe look at are the files on the same or different partitions? Are the filesystems the same type? Mount options?<div dir="auto"><br></div><div dir="auto">Weird...</div><div dir="auto"><br></div><div dir="auto"><br></div></div><br><div class="gmail_quote"><div dir="ltr">On Sat, Jun 30, 2018, 11:21 PM Donatello D <<a href="mailto:bluray.vik@gmail.com">bluray.vik@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">@Jim - this is what i use as a workaround already, but it is<br>
sub-optimal, as there will be other files that are rolled over in<br>
different intervals, so i end up reloading config multiple times.<br>
<br>
the real question is why does it work in RHEL and fail in UBUNTU?<br>
<br>
<br>
> Date: Sat, 30 Jun 2018 20:31:59 -0400<br>
> From: Jim Hendrick <<a href="mailto:james.r.hendrick@gmail.com" target="_blank" rel="noreferrer">james.r.hendrick@gmail.com</a>><br>
> To: "Syslog-ng users' and developers' mailing list"<br>
> <<a href="mailto:syslog-ng@lists.balabit.hu" target="_blank" rel="noreferrer">syslog-ng@lists.balabit.hu</a>><br>
> Subject: Re: [syslog-ng] syslog-ng not following symlinks correctly on<br>
> UBUNTU, works fine in RHEL<br>
> Message-ID:<br>
> <CANEn2idABV25G1vFa4B=<a href="mailto:WhOyuHjd3HwLMKFBHgqydH6zvH0H9w@mail.gmail.com" target="_blank" rel="noreferrer">WhOyuHjd3HwLMKFBHgqydH6zvH0H9w@mail.gmail.com</a>><br>
> Content-Type: text/plain; charset="utf-8"<br>
><br>
> hardlinks are simply additional pointers to the same inode.<br>
> symlinks contain the name of the referenced object<br>
><br>
> If you want a hack - maybe have syslog-ng reload after the file changes?<br>
> (SIGHUP)<br>
><br>
><br>
><br>
> On Sat, Jun 30, 2018 at 12:56 PM, Ankit Agarwal <<a href="mailto:ankit@travelmyheart.org" target="_blank" rel="noreferrer">ankit@travelmyheart.org</a>><br>
> wrote:<br>
><br>
> > Hi,<br>
> ><br>
> > I ran into a similar problem on Ubuntu as well.<br>
> ><br>
> > In my case, I was tracking the Tomcat localhost log file in syslog-ng but<br>
> > Tomcat creates a new log file everyday by default, and the filename changes<br>
> > (since it includes the date).<br>
> ><br>
> > Therefore, I periodically created a softlink to the localhost log file<br>
> > where the link had a constant name. The constant name is needed because I<br>
> > obviously cannot keep changing the syslog-ng configuration to match the<br>
> > day's localhost log file name.<br>
> ><br>
> > I found that the softlink did not work.<br>
> ><br>
> > Instead I had to create a hardlink.<br>
> ><br>
> > This is because the softlink's modified date does not change when the<br>
> > underlying file changes. The hardlink's modified date does change since it<br>
> > is pointing to the actual data. We need the modified date to change for the<br>
> > syslog-ng client to pick up new log entries.<br>
> ><br>
> > In my case, I periodically ran the following command via CRON in the<br>
> > Tomcat logs directory:<br>
> ><br>
> > sudo ln -f $(ls -t localhost.* | head -1) tomcat_localhost.log<br>
> ><br>
> > This is to get the latest localhost log file and create the hardlink for<br>
> > it (overwriting the older hardlink that may have been pointing to the<br>
> > previous day's localhost log file).<br>
> ><br>
> > I ran this every hour just to be safe.<br>
> ><br>
> ><br>
> > So in your case, I think you would just need to recreate the hardlink as<br>
> > soon as your log file is rotated.<br>
> ><br>
> ><br>
> > Hope this helps.<br>
> ><br>
> > Ankit<br>
> ><br>
> ><br>
> ><br>
> > ---- On Sat, 30 Jun 2018 01:13:44 -0700 *Donatello D<br>
> > <<a href="mailto:bluray.vik@gmail.com" target="_blank" rel="noreferrer">bluray.vik@gmail.com</a> <<a href="mailto:bluray.vik@gmail.com" target="_blank" rel="noreferrer">bluray.vik@gmail.com</a>>>* wrote ----<br>
> ><br>
> > syslog-ng is configured to read a symlink pointing to logs generated from<br>
> > my application which rotates the file using log4j2 rollingfile appender.<br>
> > Everything works fine till the rotation happens. after the file get rotated<br>
> > syslog-ng still seems to hold on to the older inode (which is not moved)<br>
> > and doesn't change to follow the new logs. this however does not happen in<br>
> > RHEL where syslog-ng recognizes the file is now rotated and moves to the<br>
> > new file. In both cases the sym link is always configured to point to the<br>
> > latest file. version details and logs from both OSs below.<br>
> ><br>
> > What am i missing here?<br>
> ><br>
> > UBUNTU -<br>
> > syslog-ng 3.5.6<br>
> > Installer-Version: 3.5.6<br>
> > Revision: 3.5.6-2.1 [@416d315] (Ubuntu/16.04)<br>
> > Compile-Date: Oct 24 2015 03:49:19<br>
> > Available-Modules: afsocket,afuser,tfgeoip,confgen,csvparser,<br>
> > syslogformat,afamqp,redis,afsql,affile,afsmtp,linux-<br>
> > kmsg-format,dbparser,system-source,cryptofuncs,basicfuncs,<br>
> > json-plugin,afprog,afsocket-tls,afstomp,afsocket-notls,afmongodb<br>
> > Enable-Debug: off<br>
> > Enable-GProf: off<br>
> > Enable-Memtrace: off<br>
> > Enable-IPv6: on<br>
> > Enable-Spoof-Source: on<br>
> > Enable-TCP-Wrapper: on<br>
> > Enable-Linux-Caps: on<br>
> > Enable-Pcre: on<br>
> ><br>
> > symlink is pointing to the file that gets the logs. prior to rotation the<br>
> > process watches correctly for the file (same inodes held by my app and<br>
> > syslog-ng)<br>
> ><br>
> > lrwxrwxrwx 1 root root 56 Jun 29 08:44 node1-access.log -><br>
> > /x/logs/vik-test_access.log<br>
> ><br>
> > COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME<br>
> > java 11032 vikram 53w REG 8,1 1101 1542626<br>
> > vik-test_access.log<br>
> > syslog-ng 21661 root 9r REG 8,1 1101 1542626<br>
> > vik-test_access.log<br>
> ><br>
> ><br>
> > Post rotation, syslog-ng holds on to the older file (now rotated).<br>
> ><br>
> > COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME<br>
> > java 11032 vikram 53w REG 8,1 876 1542631<br>
> > e/elasticsearch-6.2.3/logs/vik-test_access.log<br>
> > syslog-ng 21661 root 9r REG 8,1 1101 1542626<br>
> > e/elasticsearch-6.2.3/logs/vik-test_access-2018-06-30.log<br>
> ><br>
> > The same setup works perfectly fine in RHEL (version details below) where<br>
> > syslog-ng follows the new file correctly.<br>
> ><br>
> > RHEL<br>
> > syslog-ng 3.3.5<br>
> > Installer-Version: 3.3.5<br>
> > Revision: ssh+git://bazsi@git.balabit//var/scm/git/syslog-ng/syslog-<br>
> > ng-ose--mainline--3.3--master#d5d607c05251b38e821efe27bc46ac8db78dd722<br>
> > Compile-Date: Oct 18 2012 15:17:09<br>
> > Default-Modules: affile,afprog,afsocket,afuser,<br>
> > basicfuncs,csvparser,dbparser,syslogformat<br>
> > Available-Modules: afprog,afsocket-tls,dbparser,confgen,convertfuncs,<br>
> > basicfuncs,afsocket,afmongodb,csvparser,affile,dummy,syslogformat,afuser<br>
> > Enable-Debug: off<br>
> > Enable-GProf: off<br>
> > Enable-Memtrace: off<br>
> > Enable-IPv6: on<br>
> > Enable-Spoof-Source: off<br>
> > Enable-TCP-Wrapper: on<br>
> > Enable-Linux-Caps: off<br>
> > Enable-Pcre: on<br>
> ><br>
> > ____________________________________________________________<br>
> > __________________<br>
> > Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
> > Documentation: <a href="http://www.balabit.com/support/documentation/" rel="noreferrer noreferrer" target="_blank">http://www.balabit.com/support/documentation/</a>?<br>
> > product=syslog-ng<br>
> > FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
> ><br>
> ><br>
> ><br>
> ><br>
> > ____________________________________________________________<br>
> > __________________<br>
> > Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
> > Documentation: <a href="http://www.balabit.com/support/documentation/" rel="noreferrer noreferrer" target="_blank">http://www.balabit.com/support/documentation/</a>?<br>
> > product=syslog-ng<br>
> > FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
> ><br>
> ><br>
> ><br>
> -------------- next part --------------<br>
> An HTML attachment was scrubbed...<br>
> URL: <<a href="http://lists.balabit.hu/pipermail/syslog-ng/attachments/20180630/db683a38/attachment.html" rel="noreferrer noreferrer" target="_blank">http://lists.balabit.hu/pipermail/syslog-ng/attachments/20180630/db683a38/attachment.html</a>><br>
><br>
> ------------------------------<br>
><br>
> Subject: Digest Footer<br>
><br>
> _______________________________________________<br>
> syslog-ng maillist - <a href="mailto:syslog-ng@lists.balabit.hu" target="_blank" rel="noreferrer">syslog-ng@lists.balabit.hu</a><br>
> <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
><br>
><br>
> ------------------------------<br>
><br>
> End of syslog-ng Digest, Vol 159, Issue 1<br>
> *****************************************<br>
______________________________________________________________________________<br>
Member info: <a href="https://lists.balabit.hu/mailman/listinfo/syslog-ng" rel="noreferrer noreferrer" target="_blank">https://lists.balabit.hu/mailman/listinfo/syslog-ng</a><br>
Documentation: <a href="http://www.balabit.com/support/documentation/?product=syslog-ng" rel="noreferrer noreferrer" target="_blank">http://www.balabit.com/support/documentation/?product=syslog-ng</a><br>
FAQ: <a href="http://www.balabit.com/wiki/syslog-ng-faq" rel="noreferrer noreferrer" target="_blank">http://www.balabit.com/wiki/syslog-ng-faq</a><br>
<br>
</blockquote></div>