Andrej Lobovski <drejc83@hotmail.com> [20080221 18:08:58 +0100]:
Then you have two major problems: 1. why is all the date prior to 'disk full' getting lost
Sorry, i meant that logs that are lost because of disk full are not important. The logs up to the disk full are important, and also logs after disk is free are important. But I must not restart syslog-ng.
so it goes like this
boot linux, syslog-ng online, ... logging -> disk full ... not logging -> disk free ... logging again (does not matter if in same file than before disk was full or not whatever's easier :) ). syslog-ng must run all the time.
/me gives up with the final words of wisdom "dude you data is toasted, you are preserving nothing by using the 0.5 seconds it takes to restart syslog-ng...just do it" Cheers Alex