Hi Nik,

Syslog-ng should not be designed to delete files when it reaches EOF, it rather monitors the file for new lines if so.

This would be a bit destructive behaviour even if it would be a feature with a control flag:

source s_file_clearup {

  wildcard-file (

    base-dir("/tmp/")

    filename-pattern("*")

    remove-on-EOF(yes)

  );

};

But if we are looking at from your point of view, it could be enhanced to have one-time files, or drop-off files.

It could be an enhancement.

With the current behaviour of syslog-ng quick ideas to solve this use case (if workaround needed):

- syslog-ng closes a file after the reading is idle for time_reap seconds. This could be monitored externally and remove the given file.

Example message "Destination timed out, reaping; template='input-logs', filename='input-logs"

I think there is no EOF warning for files, as syslog-ng simply waits for new lines (as said above).

Regards,

Gabor

On Fri, Oct 12, 2018 at 5:55 PM Nik Ambrosch <nik@ambrosch.com> wrote:

Looking to create a drop-off directory that syslog-ng handles instead of needing to execute in a separate script.. flow would go something like this:

1) mv file.log /syslog-tmp/

2) syslog-ng reads /syslog-tmp/file.log

3) syslog-ng deletes /syslog-tmp/file.log when done consuming

Sounds simple but I can't seem to figure out a good way to do this.  The other option is to read file with a script, send out with logger (or whatever), and hope that syslog-ng is running & healthy.

Thanks.

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq

______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.balabit.com/wiki/syslog-ng-faq