Balazs Scheidler wrote:
On Tue, 2009-04-14 at 12:58 +0100, Hari Sekhon wrote:
Hi,
While I was away on holiday, another sysadmin changed the path of a 3rd party application logfile that I was I sourcing in syslog-ng (it cannot log directly to syslog). This caused the whole syslog-ng logger to basically fail to work/(re)start, giving an the error:
Starting syslog-ng: Persistent configuration file is in invalid format, ignoring; Error opening file for reading; filename='/path/to/file.log', error='No such file or directory (2)' Error initializing source driver; source='s_file_blah'
And auto-restarting the logger of course didn't work either since every time a restart is initiated the thing simply bailed out with this error.
Shouldn't this error simply throw up a warning and continue logging the rest of what's happening on the system, rather than leaving a hole in the audit trail because it cannot lock in one source??? (Even better: start regardless, do what it can and then periodically check the source again, and every time it cannot get the source open, log a warning in syslog so that it can be caught by the monitoring infrastructure)
Any suggestions for a workaround/option to prevent anything like this ever happening again in future would be welcome.
This is what syslog-ng 3.0 does by default. Every input file is checked every follow_freq() seconds and is reopened if it did not exist.
Ok, am on 2.x, will upgrade to 3.x. Does it log to syslog if the source is still unavailable every follow_freq() secs? This would be nice so that my monitoring infrastructure will alert me as to this problem rather than syslog-ng silently failing to pick up the source. Thanks -h -- Hari Sekhon Always open to interesting opportunities http://www.linkedin.com/in/harisekhon