On Mon, 2007-12-03 at 17:15 -0600, Charles G Waldman wrote:
Sirs:
Several months ago I submitted the following patch to syslog-ng, which makes the "file" source work even if the file is not present when syslog-ng starts up. (Consider the scenario where syslog-ng starts up before some other service which logs to a file, and that file has not yet been created yet.) This patch causes syslog-ng to treat the transition from "nonexistent" to "existent" the same as if the file were moved/renamed.
We are using the patched version of syslog-ng in our project and find this modification helpful. It is a very non-intrusive change, and I cannot see any negative side-effects. I would like to know if there is any chance for this patch to be incorporated into the official distribution. Thanks for your consideration.
I've received your CLA, thanks. I'm integrating your patch right now.
Patch: (also available as http://repo.mwt2.org/viewvc/patches/syslog-ng-file-source.patch )
--- syslog-ng-2.0.4/src/affile.c 2007-04-19 14:37:16.000000000 -0500 +++ syslog-ng-2.0.4-cgw2/src/affile.c 2007-06-07 11:41:00.000000000 -0500 @@ -134,7 +134,7 @@ gint fd;
msg_verbose("Follow-mode file source moved, tracking of the new file is started", - evt_tag_str("file", self->filename->str), + evt_tag_str("filename", self->filename->str), NULL);
log_pipe_deinit(self->reader, NULL, NULL); @@ -170,14 +170,26 @@ { AFFileSourceDriver *self = (AFFileSourceDriver *) s; gint fd; + gboolean file_opened, open_deferred=FALSE;
log_reader_options_init(&self->reader_options, cfg);
- if (affile_sd_open_file(self, &fd)) + file_opened = affile_sd_open_file(self, &fd); + + if (!file_opened && self->reader_options.follow_freq > 0) + { + msg_info("Follow-mode file source not found, deferring open", + evt_tag_str("filename", self->filename->str), + NULL); + open_deferred = TRUE; + fd = -1; + } + + if (file_opened || open_deferred) { self->reader = log_reader_new(fd_read_new(fd, 0), LR_LOCAL | LR_NOMREAD, s, &self->reader_options);
- if (persist) + if (persist && file_opened) { gchar *str; off_t cur_pos; --- syslog-ng-2.0.4/src/logreader.c 2007-04-20 15:11:07.000000000 -0500 +++ syslog-ng-2.0.4-cgw2/src/logreader.c 2007-06-07 11:26:12.000000000 -0500 @@ -100,29 +100,32 @@ struct stat st, followed_st; off_t pos;
- pos = lseek(self->fd->fd, 0, SEEK_CUR); - if (pos == (off_t) -1) - { - msg_error("Error invoking seek on followed file", - evt_tag_errno("error", errno), - NULL); - return FALSE; - } - - if (fstat(self->fd->fd, &st) < 0) - { - msg_error("Error invoking fstat() on followed file", - evt_tag_errno("error", errno), - NULL); - return FALSE; - } + if (self->fd->fd >= 0) + { + pos = lseek(self->fd->fd, 0, SEEK_CUR); + if (pos == (off_t) -1) + { + msg_error("Error invoking seek on followed file", + evt_tag_errno("error", errno), + NULL); + return FALSE; + } + + if (fstat(self->fd->fd, &st) < 0) + { + msg_error("Error invoking fstat() on followed file", + evt_tag_errno("error", errno), + NULL); + return FALSE; + }
- if (pos < st.st_size) - return TRUE; + if (pos < st.st_size) + return TRUE; + }
if (self->reader->options->follow_filename && stat(self->reader->options->follow_filename, &followed_st) != -1) { - if (st.st_ino != followed_st.st_ino) + if (self->fd->fd < 0 || st.st_ino != followed_st.st_ino) { /* file was moved and we are at EOF, follow the new file */ log_pipe_notify(self->reader->control, &self->reader->super.super, NC_FILE_MOVED, self);
_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
-- Bazsi