>
It is a bit hard to believe that after receiving a HUP signal syslog-ng keeps destination files open, keep-alive isn't implemented there. did you signal the supervisor process maybe?
# pgrep -fl syslog-ng
30742 supervising syslog-ng
30743 /usr/sbin/syslog-ng -p /var/run/syslog-ng.pid --fd-limit 262144
# lsof -p 30743 | grep -c deleted
285
# kill -HUP 30743
# lsof -p 30743 | grep -c deleted
290
>I'd check syslog-ng's messages.
The only one message is there:
Jul 24 09:40:50 syslog-host syslog-ng[30743]: Configuration reload request received, reloading configuration;
> BTW did you check whether the file is still being written or not?
Syslog-NG started to write to the new file at 23:59:59 just as it should. I'm seeing new log lines in the new log files started at 00:00:05. So it seems to be ok.
> You're using the date extracted from the incoming log messages so when a client still sends logs with the given day then syslog-ng will keep writing to that file so it won't close it - thus if another process unlinked it then lsof will show the file as deleted.
All the apps are configured to send logs in UTC as well as syslog-ng host is configured in UTC. Just re-checked it, the time seems to be in sync everywhere.