VI doesnt do that though (would wreak havoc with selinux and others if it did), not unless you have some uncommon vi settings. It might cause a problem if vi opens the file, the file grows while its open, and so when its written out, it basically gets truncated back. At that point syslog-ng would be trying to write past where the actual end of the file is. I've never messed with such situations, so I'm not sure what the effect of that is.

-Patrick

Sent: Fri Jan 28 2011 01:00:00 GMT-0700 (Mountain Standard Time)
From: Fegan, Joe (CSBU) <Joe.Fegan@hp.com>
To: Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu>
Subject: Re: [syslog-ng] A known syslog-ng issue/bug? 
This sounds like a standard Linux/Unix problem - a program has a file open and is actively writing to it. I open the file in vi and do "save". What actually happens is that vi unlinks the existing file and writes a completely new file that happens to have the same name. The program continues to write to the unlinked file (which is a perfectly valid thing to do in Linux/Unix).

________________________________
From: syslog-ng-bounces@lists.balabit.hu [syslog-ng-bounces@lists.balabit.hu] On Behalf Of Xuan Zhong [xuan_zhong@hotmail.com]
Sent: 27 January 2011 20:49
To: syslog-ng@lists.balabit.hu
Subject: [syslog-ng] A known syslog-ng issue/bug?

Hi,

This issue is that if someone looks at a log file generated by syslog-ng with vi, and then “accidentally” writes and saves the file, subsequent writes to the file by syslog-ng don’t appear to work.  If syslog-ng closes the file (which happens if it is “idle” for a configurable period, whose default is 1 minute), and then re-opens it when it next needs to write, the writes succeed. Similarly, “service syslog-ng reload” (or restart) will clear the problem.

Anyone experienced the similar problem?

Thanks
Xuan
______________________________________________________________________________
Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng
Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng
FAQ: http://www.campin.net/syslog-ng/faq.html