I know nothing of the timer architecture used within syslog-ng, but just to create discussion, could it be that a completed timer is missed? Something like one timer completes and while it is being processed (the file is being closed/reaped) another timer completes which is missed. This would probably only show up on systems that have been configured to log to a large number of files. Evan. Balazs Scheidler wrote:
On Thu, 2007-12-20 at 19:42 +0100, Balazs Scheidler wrote:
On Thu, 2007-12-20 at 15:22 +0100, Nagy Daniel wrote:
Hi,
At 15:00 there are many "Initializing destination file writer..." messages, which is good:
Dec 20 15:00:01 s_sys@barapp1 syslog-ng[18883]: Initializing destination file writer; template='/data/syslog/FM-$YEAR$MONTH$DAY-$HOU R0000-$HOST.log', filename='/data/syslog/FM-20071220-150000-fm12.log'
But from 15:00 to 15:19 there are no "Destination timed out, reaping" messages at all, and all files opened at 14:00 are still open according to lsof.
Every server share a common NTP server, time is good. I don't see how syslog-ng could start the timer which reaps files, the only reason that could explain this is the continous stream of incoming messages, which makes this timer starve.
I mean I could not see how it would not start. E.g. it is always started if there's at least one '$' character in the filename.
-- Evan Rempel erempel@uvic.ca Senior Programmer Analyst 250.721.7691 Computing Services University of Victoria