Hi, I don't see that the fact the file is growing while syslog-ng is being reloaded would cause something like this. it is designed to handle these cases properly. I even tried to reproduce the issue with my 3.4 tree and couldn't. There was one related change in 3.2.5 though: Author: Balazs Scheidler <bazsi@balabit.hu> 2011-05-29 19:47:19 Committer: Balazs Scheidler <bazsi@balabit.hu> 2011-10-08 12:33:16 Parent: e231e957d13af412f38db817e2621a4ece8ebe8a (LogProto: apply_state shouldn't allow file offsets over the end-of-file) Child: 32650278fb35fb6f82522df54014c8d57f1705aa ([persist]: only check the buffer size if no encoding is specified) Branches: master, remotes/origin/master Follows: v3.2.4 Precedes: v3.2.5 LogProtoBufferedServer: fixed error handling in case the persist-state cannot be restored In case an error happens while restoring the persist data, be sure to reset various state variables to indicate that the Protocol is to be restarted. Signed-off-by: Balazs Scheidler <bazsi@balabit.hu> But that would only trigger the error message if for some reason syslog-ng couldn't restore the state earlier. On Sat, Jun 30, 2012 at 5:16 PM, Francois Durand <fdur559@gmail.com> wrote:
Hi list,
I'm using syslog-ng (3.2.4) to follow some nginx log files using these directives:
source s_nginx_logs { file("/path/to/nginx/access.log" flags(no-parse)); }
When syslog-ng is reloaded, either for its own log files rotation or because a configuration update (which happens regularly when a new site is added), it does not see new data being written in followed files while it is reloading itself, and then complains about file size having changed and retransmit the whole file to my central log file collector.
Here is the warning message: syslog-ng[24608]: The current log file has a mismatching size/inode information, restarting from the beginning; state='affile_sd_curpos(/path/to/nginx/access.log) stored_inode='139419', cur_file_inode='139419', stored_size='985114', cur_file_size='997815', raw_stream_pos='1995630'
I don't see how to handle that correctly.
Any idea ?
______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.balabit.com/wiki/syslog-ng-faq
-- Bazsi