On Mon, 2010-07-05 at 17:51 +0300, Risto Vaarandi wrote:
hi all,
is file() driver intended for reading kernel messages only on Linux, or does it work for regular files also? I've tried to get the following simple configuration working, but without success:
source textfile { file("/home/risto/test.log" flags(no-parse) follow-freq(1)); }; destination testlog { file("/var/log/test.log"); }; log { source(textfile); destination(testlog); };
The source definition is identical to the example from the syslog-ng administrator guide (I've played with the options, but the result is the same).
When syslog-ng starts up, it produces the following error messages:
Follow-mode file source not found, deferring open; filename='/home/risto/test.log' The current log file has a mismatching size/inode information, restarting from the beginning; filename='/home/risto/test.log'
If the file is not there, it should try to open this file once every second (follow_freq() intervals).
If /home/risto/test.log does not exist, only the first message is produced. Is reading from regular files only supported by PE? (I am using the 3.0.7 open source version of syslog-ng.)
No, it should work with 3.0 OSE as well (even prior to that). However, I know about a bug in 3.0.7 which causes syslog-ng it incorrectly flush destination files. Do you perhaps use flush_lines(), flush_timeout() options? -- Bazsi