redirect output using symbolic links
Howdy all! If syslog-ng is configured to send messages to a particular file, which is a symbolic link, and I relink to a new file, do I need to send a HUP signal to syslog-ng before I relink? Thanks! -- ________________________ Robert Ulbrich Software Developer CAPSHER Technology, Inc. (979) 776-7520x150 rulbrich@capsher.com ________________________
Hi,
Howdy all!
If syslog-ng is configured to send messages to a particular file, which is a symbolic link, and I relink to a new file, do I need to send a HUP signal to syslog-ng before I relink?
Well, it depends... syslog-ng keeps busy destinations open, so it might happen that it will continue to log to the same file as the symlink will dereferenced only when syslog-ng opens the file. This means that the fd of the symlink's target would used during the logging. When the destination isn't busy, syslog-ng closes the file and reopens it later when needed, so this time it will dereference the symlink again. Refer to the time_reap option if interested although I don't think this is what you're after. Back to your original question right now there is no way to use a part of the message itself as the destination filename. You could use a regexp in a filter and later refer to the matched parts, but only in the template used in the log{} section. I'm not sure about the upcoming release, maybe Bazsi could provide exact information. regards, Sandor -------------------------------------------------------- NOTICE: If received in error, please destroy and notify sender. Sender does not intend to waive confidentiality or privilege. Use of this email is prohibited when received in error.
When you call open on a symbolic link the handle you get back is to the *target* of the link, not to the link itself. So data will continue to go to the old file until the app (syslog-ng) closes its existing handle and opens the link by name again. The new open call will follow the link and return a handle to the new target and then you'll be in business. So after modifying the link you will need to ensure that syslog-ng closes its existing handles and opens new ones and I believe that -HUP is the way to do that. -----Original Message----- From: syslog-ng-bounces@lists.balabit.hu [mailto:syslog-ng-bounces@lists.balabit.hu] On Behalf Of Geller, Sandor (IT) Sent: 08 May 2008 08:15 To: 'Syslog-ng users' and developers' mailing list' Subject: Re: [syslog-ng] redirect output using symbolic links Hi,
Howdy all!
If syslog-ng is configured to send messages to a particular file, which is a symbolic link, and I relink to a new file, do I need to send a HUP signal to syslog-ng before I relink?
Well, it depends... syslog-ng keeps busy destinations open, so it might happen that it will continue to log to the same file as the symlink will dereferenced only when syslog-ng opens the file. This means that the fd of the symlink's target would used during the logging. When the destination isn't busy, syslog-ng closes the file and reopens it later when needed, so this time it will dereference the symlink again. Refer to the time_reap option if interested although I don't think this is what you're after. Back to your original question right now there is no way to use a part of the message itself as the destination filename. You could use a regexp in a filter and later refer to the matched parts, but only in the template used in the log{} section. I'm not sure about the upcoming release, maybe Bazsi could provide exact information. regards, Sandor -------------------------------------------------------- NOTICE: If received in error, please destroy and notify sender. Sender does not intend to waive confidentiality or privilege. Use of this email is prohibited when received in error. ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html
participants (3)
-
Fegan, Joe
-
Geller, Sandor (IT)
-
Robert Ulbrich