Balazs Scheidler a écrit :
On Wed, 2010-07-07 at 11:18 +0200, Erwan Miran wrote:
Hi,
I'm using syslog-ng 2.0.0 (yes I know...) on a debian loghost. Files generated via df_monitor (see configuration extract below) are deleted by the monitoring process about 4 min after having been written by syslog-ng. My problem is that these files remain opened (lsof | grep deleted) by syslog-ng after deleted whereas time_reap option is set to 30s. I googled the issue and just found https://lists.balabit.hu/pipermail/syslog-ng/2003-January/004416.html which is not my exact case (macros are actually used in filenames). I didn't find any bugfix/feature on time_reap in the changelog of subsequent versions ...
Well, 2.0.0 really is ancient, and I can't really remember whether there was such a bug in it, but syslog-ng should definitely close those files, if macros are being used. (if no macros are used, time_reap is not applied).
As a workaround, you could SIGHUP the syslog-ng process, that definitely closes all files.
You're right it's an ancient one, fyi my debian version is etch (but I guess your answer would have been the same with 2.0.9 provided by lenny or even ubuntu lucid)... I already use the workaround you describe when I detect the problem and will certainly have to cron the detection+sighup but it is not... neat. Btw is the issue present in subsequent versions? Regards Erwan