On Mon, Feb 03, 2003 at 04:15:14PM +0300, Dmitry Frolov wrote:
Hello,
It seems that syslog-ng starts external program to pipe logs through only at startup. The documentation says so too and there's nothing about restart.
Syslog-ng only writes error message to internal log if program is terminated.
Feb 3 15:48:17 loghost syslog-ng[971]: io.c: do_write: write() failed (errno 32), Broken pipe Feb 3 15:48:17 loghost syslog-ng[971]: pkt_buffer::do_flush(): Error flushing data
But, in some cases it's desirable to watch for this external filter program and restart it when nesessary. Program may die suddenly or may need full restart for reconfiguration. I know that syslog-ng restarts external filter on SIGHUP, and sure i could write watcher script for automatic SIGHUPing of syslog-ng, but automatic filter program restart, perhaps with some frequency limitations would be quite useful. Is there any considerations against that?
This is the intended behaviour as without this everybody would be putting program("mail -s alert `read`"); like scripts in their configuration which would effectively DoS their log server. Regardless syslog-ng 2 (the development branch) contains code to restart the program, but possibly it will come with a knob defaulting to FALSE whether this restart should be done. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1