Hi again, On Thu, Dec 11, 2008 at 6:01 PM, Joe Shaw <joe@joeshaw.org> wrote:
Assuming that syslog-ng is monitoring the file, is there a possibility that:
1. The file is renamed 2. syslog-ng is fully caught up and hits the EOF 3. The new file isn't created yet, but syslog-ng is waiting for it to be created 4. The app continues to write some data out to the old, renamed file 5. The app is signaled and reopens the file; syslog-ng starts monitoring it
I am making an assumption in #3 which might not be true -- that syslog-ng when it encounters EOF but the file isn't recreated that it'll abandon the renamed file. If that's not true, then there's no race and I'm happy. :)
On re-reading my email, I realize I may not have conveyed the problem well enough. The worry is that in #2 syslog-ng will hit EOF and stop monitoring the old, renamed file even if the app might still write to it before it has been reopened. That is, the data in #4 would never be processed by syslog-ng. Joe