Hi, At 15:00 there are many "Initializing destination file writer..." messages, which is good: Dec 20 15:00:01 s_sys@barapp1 syslog-ng[18883]: Initializing destination file writer; template='/data/syslog/FM-$YEAR$MONTH$DAY-$HOU R0000-$HOST.log', filename='/data/syslog/FM-20071220-150000-fm12.log' But from 15:00 to 15:19 there are no "Destination timed out, reaping" messages at all, and all files opened at 14:00 are still open according to lsof. Every server share a common NTP server, time is good. Bye, Daniel Balazs Scheidler wrote:
On Thu, 2007-12-20 at 11:57 +0100, Balazs Scheidler wrote:
On Thu, 2007-12-20 at 10:38 +0100, Nagy Daniel wrote:
Hello,
The current option is time_reap(10), and according to lsof the files are still open after several minutes.
hm... can you enable "verbose" logging using the -v option? it should display a message like this:
msg_verbose("Destination timed out, reaping", evt_tag_str("template", self->filename_template->template->str), evt_tag_str("filename", dw->filename->str), NULL);
One additional note: * are your clocks set properly? because some messages may arrive several minutes later which keep the given destination alive.
Which macros are you using in the name of the destination file? The ones with an R_ prefix contain the "received" time, the S_ prefix contain the time as received in the message.