Question about file handles, programs and time_reopen
I was doing a little experimenting on syslog-ng [syslog-ng-1.6.5-6 from rpm package] and was curious what happens if the destination object is destroyed. I read the configs option "time_reopen" [mine is set to 10, I assume that is secs], does this control all output options or just network connections? 2 examples. If you have a log file that is removed while syslog-ng is running is there a way to have syslog-ng re-create the file. I tried it and the file didn't not come back even though there was more data. Same experiment with a program. Syslog-ng forks a child program at start-up but what happens if that child dies. I did a kill -9 just to see if it would detect the absence and try to re-fork. If I want these features do I need to look outside of syslog-ng [some sort of daemon watcher that will throw a HUP]. Thanks, Mike Tremaine
Hi You can always clear the file rather than actually removing it. Such as;
yerlog.log
or echo "" yerlog.log I realize that isn't what you were asking, but that's how I handle it for some log processing scripts that clear the log file upon processing. You are correct in your assessment of how syslog-ng behaves with log file creation. Mike Tremaine wrote:
I was doing a little experimenting on syslog-ng [syslog-ng-1.6.5-6 from rpm package] and was curious what happens if the destination object is destroyed. I read the configs option "time_reopen" [mine is set to 10, I assume that is secs], does this control all output options or just network connections?
2 examples.
If you have a log file that is removed while syslog-ng is running is there a way to have syslog-ng re-create the file. I tried it and the file didn't not come back even though there was more data.
Same experiment with a program. Syslog-ng forks a child program at start-up but what happens if that child dies. I did a kill -9 just to see if it would detect the absence and try to re-fork.
If I want these features do I need to look outside of syslog-ng [some sort of daemon watcher that will throw a HUP].
Thanks,
Mike Tremaine
_______________________________________________ syslog-ng maillist - syslog-ng@lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/syslog-ng Frequently asked questions at http://www.campin.net/syslog-ng/faq.html
-- # Jesse Molina # Mail = jesse@opendreams.net # Page = page-jesse@opendreams.net # Cell = 1.407.970.0280 # Web = http://www.opendreams.net/jesse/
On Sat, 2004-12-04 at 19:56, Mike Tremaine wrote:
I was doing a little experimenting on syslog-ng [syslog-ng-1.6.5-6 from rpm package] and was curious what happens if the destination object is destroyed. I read the configs option "time_reopen" [mine is set to 10, I assume that is secs], does this control all output options or just network connections?
2 examples.
If you have a log file that is removed while syslog-ng is running is there a way to have syslog-ng re-create the file. I tried it and the file didn't not come back even though there was more data.
you currently have to send a SIGHUP for that to syslog-ng.
Same experiment with a program. Syslog-ng forks a child program at start-up but what happens if that child dies. I did a kill -9 just to see if it would detect the absence and try to re-fork.
If I want these features do I need to look outside of syslog-ng [some sort of daemon watcher that will throw a HUP].
you need a daemon watcher that restarts the program if it exited while keeping the stdin opened. -- Bazsi
On Sun, 2004-12-05 at 05:35, Balazs Scheidler wrote:
Same experiment with a program. Syslog-ng forks a child program at start-up but what happens if that child dies. I did a kill -9 just to see if it would detect the absence and try to re-fork.
If I want these features do I need to look outside of syslog-ng [some sort of daemon watcher that will throw a HUP].
you need a daemon watcher that restarts the program if it exited while keeping the stdin opened.
Thank you for answer. Let me ask a follow up. Do you think it would be possible to catch that event and re-fork the program or re-open a file handle in syslog-ng? I have not looked at the source code yet, that is my next task. But I'm asking in a theoretical way since you are the one who would know best. Thanks again.. PS - I suppose this is why a named pipe is a preferred method since it is more fault tolerant. Just add more info I was doing something like this destination d_mysql { program("/usr/bin/mysql -u user --password='password' database" template("INSERT INTO logs (host, facility, priority, level, tag, date, time, program, msg) VALUES ( '$HOST', '$FACILITY', '$PRIORITY', '$LEVEL', '$TAG', '$YEAR-$MONTH-$DAY', '$HOUR:$MIN:$SEC', '$PROGRAM', '$MSG' );\n") template-escape(yes)); }; Instead of the standard method of using a pipe and have another process read the pipe. This method is nice since you don;t have to worry about restarting the reader if you restart syslog-ng. -- Mike Tremaine mgt@stellarcore.net http://www.stellarcore.net
participants (3)
-
Balazs Scheidler
-
Jesse Molina
-
Mike Tremaine