Hi everyone ! I have this message in my logs repeated several times and for different files : « syslog-ng[964]: The current log file has a mismatching size/inode information, restarting from the beginning; filename='/var/log/squid3/access.log' » This message comes from this part of the code in src/logreader.c : 644 if (cur_inode && 645 cur_inode == log_reader_get_inode(self) && 646 cur_size <= log_reader_get_size(self)) 647 { 648 /* ok, the stored state matches the current file */ 649 log_reader_update_pos(self, cur_pos); 650 return; 651 } 652 else 653 { 654 /* the stored state does not match the current file */ 655 msg_notice("The current log file has a mismatching size/inode information, restarting from the beginning", 656 evt_tag_str("filename", self->follow_filename), 657 NULL); 658 goto error; 659 } Does this mean I may have a hardware problem? Hard drive not working properly, file system damaged, … Google hasn't been really helpful so far. Greg.
Gbe gbe <gbeantipub@gmail.com> writes:
Hi everyone !
I have this message in my logs repeated several times and for different files : « syslog-ng[964]: The current log file has a mismatching size/inode information, restarting from the beginning; filename='/var/log/squid3/access.log' »
This means that the file has changed. This can happen due to being truncated, rotated away, or hardware failiure. In most cases, it's the result of log rotation, though. syslog-ng keeps track of file positions, in order to be able to continue wherever it left when restarted. But for that to work reliably, it also stores the inode and size of the file, so it can detect when a file was changed, and restart from the beginning. This is exactly what happens in your case: some logs get rotated, and syslog-ng restarts reading from the beginning of said files. Nothing to worry about. At least, if you do have rotation set up, and the messages come shortly after rotation happens. -- |8]
2011/10/7 Gergely Nagy <algernon@balabit.hu>
Gbe gbe <gbeantipub@gmail.com> writes:
Hi everyone !
I have this message in my logs repeated several times and for different files : « syslog-ng[964]: The current log file has a mismatching size/inode information, restarting from the beginning; filename='/var/log/squid3/access.log' »
This means that the file has changed. This can happen due to being truncated, rotated away, or hardware failiure.
In most cases, it's the result of log rotation, though.
syslog-ng keeps track of file positions, in order to be able to continue wherever it left when restarted. But for that to work reliably, it also stores the inode and size of the file, so it can detect when a file was changed, and restart from the beginning.
This is exactly what happens in your case: some logs get rotated, and syslog-ng restarts reading from the beginning of said files.
Nothing to worry about. At least, if you do have rotation set up, and the messages come shortly after rotation happens.
That's reassuring. However, this machine has been up for several months (I don't mean the uptime) and has never printed those messages. As far as I know the configuration hasn't changed recently. This is why I start suspecting hardware failure. Nothing else in the logs tells me about any hardware errors.
Gbe gbe <gbeantipub@gmail.com> writes:
Nothing to worry about. At least, if you do have rotation set up, and the messages come shortly after rotation happens.
That's reassuring. However, this machine has been up for several months (I don't mean the uptime) and has never printed those messages. As far as I know the configuration hasn't changed recently. This is why I start suspecting hardware failure. Nothing else in the logs tells me about any hardware errors.
I'd check the logrotate configs, to see if any of the logs syslog-ng complains about are rotated, and if so, when. Then check whether that time is around the time the warnings are printed. -- |8]
2011/10/7 Gergely Nagy <algernon@balabit.hu>:
Gbe gbe <gbeantipub@gmail.com> writes:
Nothing to worry about. At least, if you do have rotation set up, and the messages come shortly after rotation happens.
That's reassuring. However, this machine has been up for several months (I don't mean the uptime) and has never printed those messages. As far as I know the configuration hasn't changed recently. This is why I start suspecting hardware failure. Nothing else in the logs tells me about any hardware errors.
I'd check the logrotate configs, to see if any of the logs syslog-ng complains about are rotated, and if so, when. Then check whether that time is around the time the warnings are printed.
You were perfectly right. Thank you for your precious help. Greg.
participants (2)
-
Gbe gbe
-
Gergely Nagy