When I restart syslog-ng, should I be restarting all other applications that write to the log files?
I have noticed that when I restart syslog-ng (/etc/init.d/syslog restart - redhat 7) I will lose certain messages to my maillog from sendmail. If I don't restart my cron daemon, it no longer has any new messages in its log file (/var/log/cron). This is true of other apps as well.
The stopping/restarting of syslog-ng is handled by redhat's "daemon syslog-ng" and "killproc syslog-ng" scripts within /etc/init.d/syslog.
Don't restart it, use kill -HUP to reinitialize it. This way it doesn't drop opened connections -> messages will not be lost. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 url: http://www.balabit.hu/pgpkey.txt