On Tue, Jan 21, 2003 at 04:02:30PM +0100, Xavier de Labouret wrote:
Hello,
I have a strange behaviour with syslog-ng 1.4.16 and rotated files. It looks like syslog-ng keeps file descriptors opened, despite the time_reap parameter, in a file where very few logs are sent. This generates problems with log rotations.
Here is my syslog-ng.conf (extract).
--------------8<----------------
options { long_hostnames(off); sync(0); owner("root"); group("adm"); perm(0644); time_reap(30); };
source src { unix-stream("/dev/log"); internal(); udp(); }; filter f_heartbeat { facility(local7) and program(heartbeat/syslog-ng); }; destination d_heartbeat { file("/usr2/log/heartbeat.log"); };
log { source(src); filter(f_heartbeat); destination(d_heartbeat); };
-------------->8----------------
Important points are: target file is /usr2/log/heartbeat.log, time_reap is set to 30.
My "heartbeat" application is logging every 5 minutes in this file, with the appname "heartbeat/syslog-ng". *This is the only line logged to this destination*. So we have 5 minutes of inactivity between 2 logs.
I rotate heartbeat.log every 5 minutes too, 3 minutes after the call to the heartbeat application. I am using savelog for the rotation.
time_reap() is only used when a filename with macros in it is used. e.g. destination d_heartbeat { file("/usr2/log/$YEAR-$MONTH-$DAY/heartbeat.log"); }; -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1