Hi Nik,
Syslog-ng should not be designed to delete files when it reaches EOF, it rather monitors the file for new lines if so.
This would be a bit destructive behaviour even if it would be a feature with a control flag:
source s_file_clearup {
wildcard-file (
base-dir("/tmp/")
filename-pattern("*")
remove-on-EOF(yes)
);
};
But if we are looking at from your point of view, it could be enhanced to have one-time files, or drop-off files.
It could be an enhancement.
With the current behaviour of syslog-ng quick ideas to solve this use case (if workaround needed):
- syslog-ng closes a file after the reading is idle for time_reap seconds. This could be monitored externally and remove the given file.
Example message "Destination timed out, reaping; template='input-logs', filename='input-logs"
I think there is no EOF warning for files, as syslog-ng simply waits for new lines (as said above).
Regards,
Gabor