Hi,
Howdy all!
If syslog-ng is configured to send messages to a particular file, which is a symbolic link, and I relink to a new file, do I need to send a HUP signal to syslog-ng before I relink?
Well, it depends... syslog-ng keeps busy destinations open, so it might happen that it will continue to log to the same file as the symlink will dereferenced only when syslog-ng opens the file. This means that the fd of the symlink's target would used during the logging. When the destination isn't busy, syslog-ng closes the file and reopens it later when needed, so this time it will dereference the symlink again. Refer to the time_reap option if interested although I don't think this is what you're after. Back to your original question right now there is no way to use a part of the message itself as the destination filename. You could use a regexp in a filter and later refer to the matched parts, but only in the template used in the log{} section. I'm not sure about the upcoming release, maybe Bazsi could provide exact information. regards, Sandor -------------------------------------------------------- NOTICE: If received in error, please destroy and notify sender. Sender does not intend to waive confidentiality or privilege. Use of this email is prohibited when received in error.