2011/10/7 Gergely Nagy <algernon@balabit.hu>
Gbe gbe <gbeantipub@gmail.com> writes:
Hi everyone !
I have this message in my logs repeated several times and for different files : « syslog-ng[964]: The current log file has a mismatching size/inode information, restarting from the beginning; filename='/var/log/squid3/access.log' »
This means that the file has changed. This can happen due to being truncated, rotated away, or hardware failiure.
In most cases, it's the result of log rotation, though.
syslog-ng keeps track of file positions, in order to be able to continue wherever it left when restarted. But for that to work reliably, it also stores the inode and size of the file, so it can detect when a file was changed, and restart from the beginning.
This is exactly what happens in your case: some logs get rotated, and syslog-ng restarts reading from the beginning of said files.
Nothing to worry about. At least, if you do have rotation set up, and the messages come shortly after rotation happens.
That's reassuring. However, this machine has been up for several months (I don't mean the uptime) and has never printed those messages. As far as I know the configuration hasn't changed recently. This is why I start suspecting hardware failure. Nothing else in the logs tells me about any hardware errors.