On Wed, 2010-07-07 at 11:18 +0200, Erwan Miran wrote:
Hi,
I'm using syslog-ng 2.0.0 (yes I know...) on a debian loghost. Files generated via df_monitor (see configuration extract below) are deleted by the monitoring process about 4 min after having been written by syslog-ng. My problem is that these files remain opened (lsof | grep deleted) by syslog-ng after deleted whereas time_reap option is set to 30s. I googled the issue and just found https://lists.balabit.hu/pipermail/syslog-ng/2003-January/004416.html which is not my exact case (macros are actually used in filenames). I didn't find any bugfix/feature on time_reap in the changelog of subsequent versions ...
Well, 2.0.0 really is ancient, and I can't really remember whether there was such a bug in it, but syslog-ng should definitely close those files, if macros are being used. (if no macros are used, time_reap is not applied). As a workaround, you could SIGHUP the syslog-ng process, that definitely closes all files. -- Bazsi