Hi, This issue is that if someone looks at a log file generated by syslog-ng with vi, and then “accidentally” writes and saves the file, subsequent writes to the file by syslog-ng don’t appear to work. If syslog-ng closes the file (which happens if it is “idle” for a configurable period, whose default is 1 minute), and then re-opens it when it next needs to write, the writes succeed. Similarly, “service syslog-ng reload” (or restart) will clear the problem. Anyone experienced the similar problem? Thanks Xuan
This sounds like a standard Linux/Unix problem - a program has a file open and is actively writing to it. I open the file in vi and do "save". What actually happens is that vi unlinks the existing file and writes a completely new file that happens to have the same name. The program continues to write to the unlinked file (which is a perfectly valid thing to do in Linux/Unix). ________________________________ From: syslog-ng-bounces@lists.balabit.hu [syslog-ng-bounces@lists.balabit.hu] On Behalf Of Xuan Zhong [xuan_zhong@hotmail.com] Sent: 27 January 2011 20:49 To: syslog-ng@lists.balabit.hu Subject: [syslog-ng] A known syslog-ng issue/bug? Hi, This issue is that if someone looks at a log file generated by syslog-ng with vi, and then “accidentally” writes and saves the file, subsequent writes to the file by syslog-ng don’t appear to work. If syslog-ng closes the file (which happens if it is “idle” for a configurable period, whose default is 1 minute), and then re-opens it when it next needs to write, the writes succeed. Similarly, “service syslog-ng reload” (or restart) will clear the problem. Anyone experienced the similar problem? Thanks Xuan
VI doesnt do that though (would wreak havoc with selinux and others if it did), not unless you have some uncommon vi settings. It might cause a problem if vi opens the file, the file grows while its open, and so when its written out, it basically gets truncated back. At that point syslog-ng would be trying to write past where the actual end of the file is. I've never messed with such situations, so I'm not sure what the effect of that is. -Patrick Sent: Fri Jan 28 2011 01:00:00 GMT-0700 (Mountain Standard Time) From: Fegan, Joe (CSBU) <Joe.Fegan@hp.com> To: Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu> Subject: Re: [syslog-ng] A known syslog-ng issue/bug?
This sounds like a standard Linux/Unix problem - a program has a file open and is actively writing to it. I open the file in vi and do "save". What actually happens is that vi unlinks the existing file and writes a completely new file that happens to have the same name. The program continues to write to the unlinked file (which is a perfectly valid thing to do in Linux/Unix).
________________________________ From: syslog-ng-bounces@lists.balabit.hu [syslog-ng-bounces@lists.balabit.hu] On Behalf Of Xuan Zhong [xuan_zhong@hotmail.com] Sent: 27 January 2011 20:49 To: syslog-ng@lists.balabit.hu Subject: [syslog-ng] A known syslog-ng issue/bug?
Hi,
This issue is that if someone looks at a log file generated by syslog-ng with vi, and then “accidentally” writes and saves the file, subsequent writes to the file by syslog-ng don’t appear to work. If syslog-ng closes the file (which happens if it is “idle” for a configurable period, whose default is 1 minute), and then re-opens it when it next needs to write, the writes succeed. Similarly, “service syslog-ng reload” (or restart) will clear the problem.
Anyone experienced the similar problem?
Thanks Xuan ______________________________________________________________________________ Member info: https://lists.balabit.hu/mailman/listinfo/syslog-ng Documentation: http://www.balabit.com/support/documentation/?product=syslog-ng FAQ: http://www.campin.net/syslog-ng/faq.html
participants (3)
-
Fegan, Joe (CSBU)
-
Patrick H.
-
Xuan Zhong