19 Oct
2010
19 Oct
'10
3:56 p.m.
On Wed, 2010-09-29 at 08:35 -0500, Martin Holste wrote:
Yes. The problem with this, that there's no such thing as rollover. :( syslog-ng keeps expanding the template string to find out which files to write and then times out files that do not get written to after time_reap() seconds.
Ok, then can then code that times out files after time_reap() be the trigger? It wouldn't be immediate, but it should be soon after and guaranteed not to have follow-up data, right?
except if you have sparse log data during the interval. time_reap() may close a file within the same hour if the $HOUR macro is used in the filename. (for example 1 message every 5 minutes and time_reap() set to 60 seconds, it'll be closed quite a number of times). -- Bazsi