On Fri, 2009-08-28 at 08:26 +0200, G. Rayot wrote:

Hi.

Using syslog-ng OSE, is it possible to use a remote file (ie: samba share) as source file? Doing it with a local file works like a charm, but using a mounted remote file does not work (with follow_freq set to 1 or not set). The file will be read by syslog-ng only if I make a ls on the folder where the file is mounted, or cat the file. Otherwise, syslog-ng seems to not see any change in the file.

Hm... this might be a filesystem issue. In order to have the file checked if some more data was appended to it, syslog-ng performs an fstat() on the opened file. This information may be cached by smbfs/cifs on the client side. As I see smbfs indeed does some time based caching: /* * Check whether we've recently refreshed the inode. */ if (time_before(jiffies, SMB_I(inode)->oldmtime + SMB_MAX_AGE(s))) { VERBOSE("up-to-date, ino=%ld, jiffies=%lu, oldtime=%lu\n", inode->i_ino, jiffies, SMB_I(inode)->oldmtime); goto out; } Have you tried using cifs instead of smbfs? That seems to be the current client side implementation of SMBFS these days. -- Bazsi